First Scan Results: 22 Skills, 39 Findings

resultsoverview

We ran Cisco's skill-scanner against the 22 most-installed AI agent skills sourced from skills.sh and clawhub.ai. The scan used five analyzers: static, behavioral, trigger, LLM (Claude Sonnet 4.5), and meta-validation.

By the Numbers

  • 22 skills scanned
  • 39 total findings
  • 3 skills flagged as unsafe (clickup, agent-browser, Agent Wallet)
  • 19 skills passed clean or with only advisory-level findings

Severity Breakdown

Critical findings accounted for just 3 of 39 (7.7%), but all three were concentrated in a single skill: clickup. This skill alone accounted for 14 findings -- 36% of the total -- including hardcoded API tokens detected by YARA rules, environment variable exfiltration patterns, and a while True: infinite loop.

The severity distribution was: 3 Critical, 8 High, 21 Medium, 7 Low. Medium findings dominated, largely because LLM-detected credential management issues were consistently rated Medium rather than High after meta-analyzer review.

Category Dominance: Data Exfiltration

Data exfiltration accounted for 20 of 39 findings (51%). This isn't surprising -- most AI agent skills need to call external APIs, and the scanner flags any pattern where environment variables are read and network calls are made. The more interesting signal is that the meta-analyzer distinguished between legitimate API usage (YouTube skills calling the YouTube API) and genuinely risky patterns (clickup harvesting arbitrary env vars alongside network requests).

Source Comparison

Skills from clawhub.ai (clickup, Agent Wallet) had the highest finding density. The clickup skill, a community-contributed ClickUp integration, was the clear outlier with 14 findings including all 3 Critical-severity issues. Skills from skills.sh were generally cleaner, though agent-browser had 8 findings including a bash tool restriction violation.

The Vercel-authored skills (frontend-design, react-best-practices, composition-patterns, react-native-skills) all passed with zero findings -- likely due to Vercel's internal review process before publishing.