26.1% of Marketplace Agent Skills Carry a Vulnerability

Notes on Agent Skills in the Wild: An Empirical Study of Security Vulnerabilities at Scale (arXiv:2601.10338) — Yi Liu, Weizhe Wang, Rui Feng, Yao Zhang, Guangquan Xu, Gelei Deng, Yue-Ying Li, L. Zhang · January 2026

Note published July 23, 2026 · written by SkillFed’s research pipeline from the paper above · how these notes are made

AI-assisted notes · reviewed by SkillFed Skill security

Researchers scraped 42,447 agent skills off two live marketplaces — skills.rest and skillsmp.com — and ran 31,132 unique packages through SkillScan, a three-stage detector chaining static/regex analysis, an LLM-Guard input screen, and a Claude 3.5 Sonnet classifier tuned to flag security patterns. The corpus got split three ways to keep the taxonomy honest: one slice built the pattern taxonomy, one calibrated detection rules, one validated it. Against 200 skills hand-labeled by two researchers with penetration-testing backgrounds (inter-annotator agreement κ=0.83), SkillScan hit 86.7% precision and 82.5% recall.

The scan turned up 8,126 vulnerable skills spanning 14 distinct patterns across four categories: prompt injection, data exfiltration, privilege escalation, and supply-chain risk. 26.1% of everything scanned carries at least one vulnerability — data exfiltration (13.3%) and privilege escalation (11.8%) are the two biggest categories, and 5.2% show high-severity patterns consistent with deliberate malice. Skills bundling executable scripts are 2.12 times more likely to be vulnerable than instruction-only ones (p<0.001). Security- and red-team-tagged skills score worst at 67.4%, which blends legitimate dual-use offensive tooling in with actual malware. Strip that category out and prevalence only drops to 24.8%. The authors' own sensitivity analysis, accounting for survivorship bias (already-removed malicious skills never made it into the sample), puts true prevalence at 23–30%.

Key numbers

Skills with at least one vulnerability	26.1%
Data exfiltration prevalence	13.3%
Privilege escalation prevalence	11.8%
Vulnerability odds, scripted vs. instruction-only skills	2.12x (p<0.001)
SkillScan detector precision / recall	86.7% / 82.5%

What this means for skill authors

This is the empirical baseline for a claim skill marketplaces would rather not test: skills run on implicit trust with close to no vetting, and today's install flow is one yes/no gate that hands over everything a skill's manifest asks for. The sharpest actionable finding is the 2.12x odds ratio on bundled scripts — risk concentrates exactly where a marketplace's incentive to just list everything runs hardest, because executable code is harder to eyeball than plain instructions.

For skill authors, shipping executable code costs credibility unless the skill genuinely needs to run something — pinning dependencies and dropping unnecessary sudo or credential access would knock out a meaningful slice of the supply-chain and privilege-escalation counts on their own. For skill users, the number to plan around is the 23–30% band, not the 26.1% headline: a static install/don't-install decision can't tell you which of fourteen distinct failure modes a given skill might carry.

The methodology is the real lesson for anyone building a vetted catalog: no single detector caught everything here. Static analysis, an LLM input guard, and a semantic classifier each catch different failure modes, and layering them is what pushed precision into the high 80s. Treating pre-install vetting and capability-based permission systems as complements rather than substitutes is the more honest framing — and it's the same layered-detection logic behind qualitative approaches like dual-tool scanning in a vetted catalog.

Skills related to this research

Privesc Linpeas Privesc Linpeas runs comprehensive post-exploitation scans to uncover privilege escalation opportunities on Linux systems, checking for SUID/SGID binaries, sudo misconfigurations, exposed credentials, and kernel vulnerabilities. Results are color-coded by severity and mapped to exploitation techniques, enabling rapid identification of the highest-confidence escalation paths during authorized penetration tests and red team engagements.★ 181 privilege-escalation-methods This skill covers systematic approaches to elevate from low-privilege shells to root or administrator access on compromised systems. It addresses both local escalation paths—such as exploiting misconfigured sudo, capabilities, and scheduled tasks on Linux—and Windows-specific vectors including token impersonation and service abuse. For domain environments, it includes Active Directory attacks like Kerberoasting, golden tickets, and credential harvesting via LLMNR poisoning.★ 4,440 security-scanner This skill scans your code for security vulnerabilities and provides actionable remediation guidance. It helps development teams quickly identify and address potential risks before they reach production, streamlining the security review process.★ 84 Linux Pentesting Commands Linux Pentesting Commands organizes shell commands across the full penetration testing lifecycle: reconnaissance, enumeration, exploitation, privilege escalation, and post-exploitation. It covers reconnaissance techniques, service discovery, SUID/capability enumeration, reverse shells, sudo exploitation, and persistence methods with practical examples.★ 8

Related notes

References

Liu, Y., Wang, W., Feng, R., Zhang, Y., Xu, G., Deng, G., Li, Y.-Y., & Zhang, L. (2026). Agent Skills in the Wild: An Empirical Study of Security Vulnerabilities at Scale. arXiv:2601.10338.