Security scan results for AI agent skills
1221 skills from 27 registries, scanned with Cisco skill-scanner's static, behavioral, LLM and meta analyzers. Every skill gets its own page with findings, what was checked, and what was not.
Findings by category
Most recent critical findings
52 critical, 116 findings. Scanned 2026-10-22.
2 critical, 3 findings. Scanned 2026-10-22.
9 critical, 15 findings. Scanned 2026-10-22.
3 critical, 13 findings. Scanned 2026-10-22.
6 critical, 8 findings. Scanned 2026-10-22.
Latest research
The top 100 moved: 94 of today's most-installed skills were not in our corpus
We re-pulled the skills.sh top 100 by installs eight months after the first snapshot. Only six skills overlapped. We scanned the 476 skills behind the other 94 and found one vendor's skill set republished under at least seven owners, two false positives in the top 60, and a Microsoft repo whose CRITICALs are mostly the scanner misreading infrastructure code.
Two scanners, one corpus: Cisco skill-scanner and NVIDIA SkillSpector on 1,302 skills
We ran NVIDIA's SkillSpector in static mode over every skill the Cisco scanner had already scanned. At the strict tier the two agree 80% of the time with kappa 0.26; at the loose tier kappa is 0.07. Where they disagree, and what a second verdict does and does not tell you.
618 skills, 650 scans, two registries: what a full LLM and meta scan shows
Results from scanning 618 distinct AI agent skills (650 scans) from ClawHub, skills.sh, and major skill repos with every analyzer enabled: 22% flagged, ClawHub far ahead, and most CRITICALs in a handful of security tools.
What this site is
skillscan.io publishes what an automated scanner finds in the skills people actually install from skills.sh, ClawHub and other sources, plus a scan history per skill so drift is visible. It is not a benchmark of scanners (that is skillscan.sh) and it is unrelated to the SkillScan career assessment. Read the methodology and limitations before treating any verdict as final, and download the dataset if you want to check our work.