State of Agent Skill Security (April 24, 2026)
We scanned 2,674 successful marketplace listings across public skill registries and found 2,673 unique skills after deduplication.
AgentVerus Scanner v0.8.0 | April 24, 2026
Update history: /report-updates.json
Methodology Note — Deduplication
This report starts from raw listings, not a pre-cleaned corpus. Successful scans are deduplicated by content hash first and canonical URL second, so mirrors and duplicate source listings do not inflate the published totals.
Executive Summary
The public skill ecosystem is substantially larger than the historical February 2026 website snapshot, and the current scanner is materially stricter around capability-contract mismatches, authenticated workflows, and browser-session handling. The important improvement in this refresh is not just new counts. It is the publication pipeline itself: the website report now comes from a fresh full rerun with explicit cross-source deduplication instead of a stale historical file.
How to read the badge shift versus February 2026. The February report showed 95.5% CERTIFIED using scanner v0.4.0. This report shows 41.8% CERTIFIED using scanner v0.8.0. That movement is almost entirely driven by scanner calibration — v0.5–v0.8 added capability-contract matching (nine of the top fifteen findings are contract mismatches), evasion detection, and tightened behavioral/content scoring. The same skill scanned in February would often drop a tier today because its declared manifest does not match the behavior the scanner now infers. Treat this as a stricter yardstick, not a regressing ecosystem.
What We Scanned
- ClawHub: 0 unique skills from 0 current listings. Note: ClawHub's public
/api/v1/skillslisting endpoint returned zero entries throughout this run; individual downloads continue to work, and live user scans of ClawHub-hosted skills continue to flow into AgentVerus from the web and API. The zero here reflects a discovery-API gap, not an empty marketplace. - skills.sh: 2,673 unique skills not already represented by higher-priority sources (4,000 sitemap entries, 2,674 scanned, 120 failures)
- Unique total: 2,673 skills after deduplication by content hash and canonical URL
Key Numbers
| Metric | Count | Percentage |
|---|---|---|
| 🟢 CERTIFIED | 1,118 | 41.8% |
| 🟡 CONDITIONAL | 1,320 | 49.4% |
| 🟠 SUSPICIOUS | 182 | 6.8% |
| 🔴 REJECTED | 53 | 2.0% |
| Total unique skills | 2,673 | 100% |
Most Common Findings
| # | Finding | Occurrences | Severity |
|---|---|---|---|
| 1 | No explicit safety boundaries | 1,785 | LOW |
| 2 | Unknown external reference | 1,705 | LOW |
| 3 | Capability contract mismatch: inferred network access is not declared | 1,449 | MEDIUM |
| 4 | Capability contract mismatch: inferred command execution is not declared | 1,339 | HIGH |
| 5 | Capability contract mismatch: inferred file read is not declared | 1,102 | MEDIUM |
| 6 | Capability contract mismatch: inferred documentation ingestion is not declared | 1,035 | MEDIUM |
| 7 | Safety boundaries defined | 627 | INFO |
| 8 | Capability contract mismatch: inferred file write is not declared | 507 | MEDIUM |
| 9 | Unknown external reference | 499 | MEDIUM |
| 10 | Capability contract mismatch: inferred package bootstrap is not declared | 444 | MEDIUM |
| 11 | Error handling instructions present | 434 | INFO |
| 12 | Output constraints defined | 421 | INFO |
| 13 | Missing or insufficient description | 317 | LOW |
| 14 | Package bootstrap execution detected (inside code block) | 276 | MEDIUM |
| 15 | High-risk workflow lacks explicit safety boundaries | 261 | MEDIUM |
Lowest-Scoring Skills
| Skill | Score | Badge | Top Issue | Primary Source |
|---|---|---|---|---|
apify-actor-development |
15 | REJECTED | Download-and-execute pattern detected | skillssh |
apify-actorization |
22 | REJECTED | Download-and-execute pattern detected | skillssh |
main |
23 | REJECTED | Environment variable access + network send (credential harvesting) | skillssh |
openclaw-control-center |
29 | REJECTED | Environment variable access + network send (credential harvesting) | skillssh |
fullstack-dev |
30 | REJECTED | Environment variable access + network send (credential harvesting) | skillssh |
paperclip-ai-orchestration |
31 | REJECTED | Environment variable access + network send (credential harvesting) | skillssh |
voicebox-voice-synthesis |
35 | REJECTED | Environment variable access + network send (credential harvesting) | skillssh |
shopify-hydrogen |
42 | REJECTED | Capability contract mismatch: inferred command execution is not declared | skillssh |
portless |
49 | REJECTED | Capability contract mismatch: inferred credential access is not declared | skillssh |
browser-testing-with-devtools |
52 | REJECTED | Direct instruction override detected | skillssh |
Methodology
- ClawHub entries were fetched from the public marketplace API and scanned via bundle downloads.
- skills.sh entries were fetched from the sitemap, resolved to raw GitHub SKILL.md URLs, then scanned.
- Successful scan results were deduplicated by sha256 content hash and canonical URL before badge counts were published.
- When the same skill appeared in multiple sources, report provenance preferred ClawHub over skills.sh and the registries over supplemental GitHub discovery.
Expanded Discovery
Outside the two baseline registries, we also ran a supplemental public GitHub discovery pass. That scan found 4,308 net-new unique skills after deduplicating against the baseline report.
- Raw discoveries: 7,799
- Unique scan targets after canonicalization: 5,692
- Successfully scanned supplemental targets: 5,692
- Snapshot: /report-snapshots/github-expanded-discovery-2026-04-24-v0.8.0
This report was generated from a fresh v0.8.0 rerun on April 24, 2026.