Research
Analysis, methodology notes, and observations from the scans. Atom feed.
The top 100 moved: 94 of today's most-installed skills were not in our corpus
We re-pulled the skills.sh top 100 by installs eight months after the first snapshot. Only six skills overlapped. We scanned the 476 skills behind the other 94 and found one vendor's skill set republished under at least seven owners, two false positives in the top 60, and a Microsoft repo whose CRITICALs are mostly the scanner misreading infrastructure code.
Two scanners, one corpus: Cisco skill-scanner and NVIDIA SkillSpector on 1,302 skills
We ran NVIDIA's SkillSpector in static mode over every skill the Cisco scanner had already scanned. At the strict tier the two agree 80% of the time with kappa 0.26; at the loose tier kappa is 0.07. Where they disagree, and what a second verdict does and does not tell you.
618 skills, 650 scans, two registries: what a full LLM and meta scan shows
Results from scanning 618 distinct AI agent skills (650 scans) from ClawHub, skills.sh, and major skill repos with every analyzer enabled: 22% flagged, ClawHub far ahead, and most CRITICALs in a handful of security tools.
False-positive register
A maintained list of scanner findings on skillscan.io that we believe are wrong, with the reason, so CRITICAL counts can be read with the right discount.
Skill Scanner Independently Detected the ClawHavoc Malware Campaign
Koi AI found 341 malicious skills on ClawHub. Cross-referencing our scan results, Cisco's skill-scanner independently detected the same malware campaign — including the same C2 IP address and distribution patterns.
First Complete LLM+Meta Scan: 585 Skills Analyzed
After several iterations, API credit exhaustion, and pipeline fixes, we've completed our first clean run with full LLM and meta-analysis. Key insight: LLM analysis catches 83x more social engineering attacks than static analysis.
Discovering Silent Pipleine Failures: The LLM Analysis Wasn't Actually Running?!
We discovered that 540 of our scans silently failed to run LLM and meta-analysis due to exhausted API credits. The scanner reported success, but the analysis never happened. Here's how we found the bug and what the real results look like.
When the Scanner Scans the Scanner: ClawDefender and the False Positive Problem
ClawDefender, a security skill for OpenClaw agents, was flagged with 37 findings and 22 CRITICAL severity -- making it the highest-finding-count skill in our dataset. Every single finding was a false positive.
Exploring Security Testing Capabilities in the AI Agent Skills Ecosystem
AI agent skills execute with full permissions and minimal oversight. An academic study found 26% contain vulnerabilities. We built a prototype automated scanning pipeline to explore the risk landscape.
First Scan Results: 22 Skills, 39 Findings
An overview of our initial scan of the top 22 AI agent skills from skills.sh and clawhub.ai, revealing 3 unsafe skills and a dominant data exfiltration pattern.
Static-Only vs LLM-Enhanced Scanning
Comparing what static analysis catches versus what Claude Sonnet 4.5 finds -- and why the difference matters for AI agent security.
Meta-Analyzer Validation: Reducing False Positives
How the meta-analyzer reviews LLM findings for legitimacy, downgrades false alarms, and adds exploitability context.
Scaling to top 50 Skills: New Finding Categories Emerge
Expanding from 22 to 62 (the top 50 from skills.sh plus our prior scans), skills revealed two new threat categories -- prompt injection and tool chaining abuse -- and surfaced browser-use as a high-risk skill class.