Skillselion Research · Edition of 2026-08-12
The Agent Skill Security Census
We collected every published audit of the AI agent skill ecosystem: 41,791 verdicts from 5 independent auditors across 79,848 listings. 87.8% of listings have never been audited. The flagged ones include Microsoft, Anthropic and Vercel.
On 2026-08-12 we dumped the whole Skillselion production catalog and read the audit trail. The audited 12.2% of listings carries 83.3% of all installs, so the watched core is small and busy while 70,090 listings sit in the dark. Over half of audited skills carry flags. The flagged list includes the ecosystem’s biggest names. And the auditors themselves disagree on 12.7% of the skills two of them both rated. You can reproduce every number from the dataset; the method and its limits are in the methodology.
Finding 01
Audits go where the installs are. Almost nowhere else.
9,758 listings, 12.2% of the census, carry at least one audit. That thin slice holds 137,238,408 installs, 83.3% of every install we counted. The median audited listing has about 1,700 installs; the median unaudited one has 7. Auditors triage by popularity, which protects the crowd and leaves 70,090 listings with no published review at all. If you install from the long tail, you are the review.
- Share of installs covered by an audit83.3%
- Share of listings ever audited12.2%
Finding 02
More than half of audited skills carry flags
Take the worst verdict each audited listing received: 55.7% land at MEDIUM or above. 1,346 listings are flagged HIGH or CRITICAL, and together they hold 15,221,597 installs. 1,366 listings, 14.0% of everything audited, fail at least one provider’s audit outright. One flag records capability and findings: shell execution, browser control, network reach. It is not a verdict of malice.
- LOW (61,912,695 installs)4,278
- MEDIUM (59,856,157 installs)4,089
- HIGH (12,194,885 installs)992
- CRITICAL (3,026,712 installs)354
Finding 03
The flagged list includes every major vendor
Microsoft’s azure-validate is rated CRITICAL with 517,228 installs. Vercel Labs’ agent-browser is rated HIGH with 659,465. Anthropic’s own skill-creator is rated HIGH with 348,833. These are the ecosystem’s most capable tools, and the flags track that capability: deploy scripts, browser drivers, shell runners. A flag on azure-validate describes what the tool can reach, never Microsoft’s intent. Risk in this ecosystem concentrates in the most useful, most installed code, whoever publishes it.
- ByteDance Lark (9 flagged listings)2,440,132
- Microsoft (14 flagged listings)1,153,302
- Vercel (24 flagged listings)731,729
- Anthropic (13 flagged listings)577,993
- Google (11 flagged listings)94,343
- OpenAI (12 flagged listings)50,785
Per-listing verdicts are public: each linked listing page shows its five-provider audit results, and the dataset carries every verdict in this census. skill-creator (Anthropic, HIGH, 348,833 installs) · pdf (Anthropic, HIGH, 177,212 installs) · playwright-cli (Microsoft, HIGH, 116,690 installs)
Finding 04
Over half of real-world installs can run a shell
Skills declare what they need. Across the 23,541 listings whose documentation our enrichment pipeline has parsed (29.5% of the catalog, holding 78.0% of all installs), shell execution appears on skills carrying 55.7% of those installs. Network access rides on 55.2%, filesystem access on 57.4%. 2,754 listings declare shell and network together, 51,755,286 installs of code that can both execute commands and phone out. Measured against the entire census, installs on shell-capable skills are at least 43.5%, a floor, since two thirds of listings are not yet parsed.
- Filesystem access (7,618 listings)57.4%
- Shell execution (4,982 listings)55.7%
- Network access (5,364 listings)55.2%
- API credentials (1,937 listings)26.4%
- Secrets handling (1,263 listings)8.7%
Finding 05
The blind spot: shell-capable and never audited
Put the two previous findings together. Of the 4,982 parsed listings that declare shell execution, 3,137, 63.0%, have never been audited by any provider. Those unreviewed shell-capable skills hold 15,858,667 installs, about the same install mass as everything flagged HIGH or CRITICAL. The flagged code has at least been read. This set has not.
Finding 06
The auditors disagree about what safe means
Five providers audit this ecosystem: Socket, Snyk, Gen Agent Trust Hub, ZeroLeaks and Runlayer. 99.6% of audited listings carry verdicts from at least two of them, a median of 5 per listing. On 1,233 listings, 12.7% of the multi-rated set, one auditor says HIGH or CRITICAL while another says LOW or SAFE about the same code. Fail rates spread the same way, from Snyk failing 697 listings to ZeroLeaks failing zero. Agent-skill auditing is young, and its standards have not converged. Read two verdicts before you trust one.
- Socket (70 fails)9,728
- Snyk (697 fails)9,716
- Gen Agent Trust Hub (478 fails)9,715
- ZeroLeaks (0 fails)6,857
- Runlayer (371 fails)5,775
Method
Methodology
The census is a complete dump of the Skillselion production catalog taken on 2026-08-12: 79,848 listings and 164,841,042 cumulative installs, aggregating public registry data, chiefly the skills.sh registry, alongside GitHub and other public sources. Audit verdicts are the per-provider results the skills.sh registry publishes for each listing; we count each listing’s worst verdict as its risk level and never re-score anything ourselves. Installs count registry install events, not active users.
Permission figures come from our enrichment pipeline, which parses each skill’s SKILL.md and documentation for declared capabilities. It has parsed 23,541 listings so far, 29.5% of the catalog holding 78.0% of installs, and every permission statistic on this page names that denominator. Two limits to keep in mind: a declared permission is what the documentation says, not a sandbox measurement, and unparsed listings make every permission number a floor rather than a ceiling.
A flag is an auditor’s published judgment of capability and findings, not an accusation of intent. Skillselion is an independent project and is not affiliated with Anthropic, OpenAI, Cursor, Claude, Claude Code, Codex, or any audit provider named here.
Data
Download the dataset
The full census runs 79,848 rows, one per listing, with per-provider verdicts, worst risk level, outright-fail count, declared permissions, enrichment coverage, installs and publisher. It is free to use with attribution under CC BY 4.0: cite “Skillselion Agent Skill Security Census, August 2026” and link this page.
FAQ
Questions journalists ask
Are AI agent skills safe to install?
Most have never been checked: 87.8% of the 79,848 listings in this census carry no audit from any provider. The audited 12.2% covers 83.3% of all installs, so the popular core is watched and the long tail is not. Before installing, read the listing’s audit verdicts and its declared permissions, and treat an unaudited skill that wants shell or network access as unreviewed code.
Does a HIGH or CRITICAL flag mean a skill is malicious?
No. A flag records what an auditor found and what the code is able to do, such as executing shell commands, driving a browser or reaching the network. Capable tools from Microsoft, Anthropic and Vercel carry flags for that power. The census reports the verdicts; it does not accuse any publisher of bad intent.
Who audits AI agent skills?
Five independent providers published the verdicts this census counts: Socket, Snyk, Gen Agent Trust Hub, ZeroLeaks and Runlayer. Their results are distributed through the skills.sh registry, and Skillselion aggregates them per listing. Skillselion did not run its own scans for this census.
Can I reuse these numbers or the dataset?
Yes. Cite "Skillselion Agent Skill Security Census, August 2026" and link this page. The raw dataset (79,848 rows with per-provider verdicts, worst level, declared permissions and installs) is downloadable on this page under CC BY 4.0.