26.1% of Marketplace Agent Skills Carry a Vulnerability

Notes on Agent Skills in the Wild: An Empirical Study of Security Vulnerabilities at Scale (arXiv:2601.10338) — Yi Liu, Weizhe Wang, Rui Feng, Yao Zhang, Guangquan Xu, Gelei Deng, Yue-Ying Li, L. Zhang · January 2026

Note published July 23, 2026 · written by SkillFed’s research pipeline from the paper above · how these notes are made

Researchers scraped 42,447 agent skills off two live marketplaces — skills.rest and skillsmp.com — and ran 31,132 unique packages through SkillScan, a three-stage detector chaining static/regex analysis, an LLM-Guard input screen, and a Claude 3.5 Sonnet classifier tuned to flag security patterns. The corpus got split three ways to keep the taxonomy honest: one slice built the pattern taxonomy, one calibrated detection rules, one validated it. Against 200 skills hand-labeled by two researchers with penetration-testing backgrounds (inter-annotator agreement κ=0.83), SkillScan hit 86.7% precision and 82.5% recall.

The scan turned up 8,126 vulnerable skills spanning 14 distinct patterns across four categories: prompt injection, data exfiltration, privilege escalation, and supply-chain risk. 26.1% of everything scanned carries at least one vulnerability — data exfiltration (13.3%) and privilege escalation (11.8%) are the two biggest categories, and 5.2% show high-severity patterns consistent with deliberate malice. Skills bundling executable scripts are 2.12 times more likely to be vulnerable than instruction-only ones (p<0.001). Security- and red-team-tagged skills score worst at 67.4%, which blends legitimate dual-use offensive tooling in with actual malware. Strip that category out and prevalence only drops to 24.8%. The authors' own sensitivity analysis, accounting for survivorship bias (already-removed malicious skills never made it into the sample), puts true prevalence at 23–30%.