An agent skill is a folder of instructions someone else wrote for your AI agent. Everyone is racing to make them easier to install. We went looking for what is actually inside them.
Every number on this page is reproducible: skillxray scan <owner/repo> on any repository in the corpus gives you the same result, because the tool that produced these numbers is the same one you can install.
The headline is not "the ecosystem is full of malware." It isn't. The headline is that nobody is checking — and when you do check, roughly half of all published skills contain something a careful reviewer would want to see first.
skillxray charges each rule once and maps the remaining score to a letter. An A is not a clean bill of health; it means nothing serious was detected.
The single most common risky pattern is not an attack at all — it is the ecosystem's default posture. — of all published skills pre-approve powerful tools (Bash and friends) through allowed-tools. Install one and its commands may run without asking you again.
Most findings have plausible innocent explanations. These do not. Counted per skill, at MEDIUM or above.
| Signal | Skills |
|---|
| Rule | Severity | What it detects | Skills |
|---|
A scanner that cries wolf gets muted, and a survey built on a noisy scanner is worse than no survey. Calibrating against this corpus threw away more findings than it kept:
| What the first cut flagged | Why it was wrong |
|---|---|
The word cookies as a credential path | Matched import { cookies } from "next/headers" — and advice that said never store cookies. 3,364 of 5,348 hits were noise. |
curl … | sh from astral.sh, rustup, Docker | That is the documented install command for uv and Rust. Rating it CRITICAL is how you teach people to ignore a scanner. |
| Any ANSI escape sequence | Matched docs about terminals and TUI colour codes. Only conceal (CSI 8m), OSC 8 and OSC 52 are actually deceptive. |
| U+FEFF and emoji joiners as "hidden text" | A byte-order mark is an editor artefact; U+200D is how 👨👩👧 is built. 243 of 279 hits were benign. |
base64.b64decode(...) into JSON | Ordinary data handling. Only decoding into a shell or eval hides a payload. |
| ngrok and canarytokens as exfil endpoints | ngrok is an everyday dev tunnel; canarytokens are a defensive product. |
Across calibration rounds this dropped ~4,900 findings and demoted ~1,600 more. Anthropic's own skill repository — 18 skills — grades A across the board with nothing above LOW, which is the control this scanner is held to.
Limitations, stated plainly. This is static analysis: it reads text, it does not run anything, and it cannot know intent. A low grade is not an accusation — offensive-security skills legitimately contain dangerous-looking commands, and ~7% of high-severity skills are openly labelled pentest or red-team tooling. Conversely an A only means nothing matched; a novel attack would score A too. Skills were sampled from 596 repositories discovered through official sources, awesome-lists, search and community collections, so this is a broad sample, not a census. Two repositories contributed disproportionately many skills. We are not naming individual repositories, because a finding is a prompt for review, not a verdict.
If you install skills, the useful habit is the same one you already have for dependencies: look before you trust, and notice when something changes underneath you.
# x-ray a skill before it ever touches your machine skillxray scan owner/repo # check everything already installed skillxray scan # fingerprint them, then detect any file that changes later skillxray lock skillxray verify
If you publish skills, running skillxray scan . in CI takes one step and tells your users you looked.