Scaling to top 50 Skills: New Finding Categories Emerge

resultsskills.shprompt-injectionbrowser-use

We expanded our scan coverage from 22 skills to 62, adding the top 50 skills from skills.sh alongside the original clawhub.ai skills. The results: 62 total findings across 5 unsafe skills, with two entirely new threat categories that didn't appear in the initial scan.

The Numbers

  • 62 skills scanned (up from 22)
  • 62 total findings (up from 39)
  • 5 unsafe skills (up from 3): clickup, agent-browser, browser-use (new), expo-api-routes (new), Agent Wallet
  • 57 clean or advisory-only skills (92% safe rate)

The safe rate held steady at 92% even as we tripled coverage, suggesting the initial 22-skill sample was representative.

New Threat Categories

Two categories appeared for the first time in this expanded scan:

Prompt injection (4 findings) -- The LLM analyzer identified indirect prompt injection patterns where skills instruct the agent to fetch and act on external content without validation. The doc-coauthoring skill tells the agent to "use the appropriate integration to fetch" shared documents -- creating a transitive trust vector where malicious content in an external document could hijack the agent's behavior. The canvas-design skill uses a two-stage pattern where the agent generates a "design philosophy" and then follows it without re-validation, a subtler form of self-prompt-injection. These are classified under AITech-1.2 (Indirect Prompt Injection).

Tool chaining abuse (2 findings) -- YARA rules detected patterns where skills reference both read and write HTTP methods (GET, POST, PUT, DELETE) in ways that suggest read-then-exfiltrate chains. Both findings came from expo-api-routes, though the meta-analyzer assessed the skill as fundamentally safe -- it's a documentation-only skill with no executable code. This is a case where static pattern matching over-triggers on educational content.

browser-use: The Standout Risk

browser-use emerged as the most architecturally concerning skill in the expanded dataset, with 8 findings including HIGH-severity command injection and data exfiltration.

The core issue: browser-use provides an agent with full control over the user's Chrome browser -- including cookies, active sessions, and extensions -- via shell=True execution of browser automation commands. The LLM analyzer flagged this as a credential/session exposure risk (AITech-8.2.3: Data Exfiltration via Agent Tooling), noting that an attacker could craft instructions to navigate to malicious sites, extract session cookies, or exfiltrate authentication tokens.

The skill also has a transitive trust problem: it interacts with arbitrary web pages whose content the agent processes, creating an indirect prompt injection surface. A malicious page could contain instructions that manipulate the agent's behavior.

This is a fundamentally different risk profile from the clickup skill (which has bad credential hygiene but limited scope). browser-use grants the agent ambient authority over the user's entire browser session.

expo-api-routes: False Alarm Study

expo-api-routes was flagged as CRITICAL due to a YARA rule matching curl http://localhost:8081/api/hello as command injection. But the meta-analyzer's overall assessment was "SAFE -- purely educational markdown with no executable code." This is a documentation skill that teaches Expo API route patterns. The CRITICAL finding is a clear false positive from static pattern matching -- the curl command appears in a code example, not in executable code.

This case validates the meta-analyzer's value: without it, a CRITICAL finding would demand immediate triage. With it, the team can see the context and deprioritize accordingly.

Category Breakdown at Scale

At 62 findings, the category distribution is:

  • Data exfiltration: 24 (39%) -- still dominant, but dropped from 51% in the 22-skill scan as new categories diluted the share
  • Policy violation: 11 (18%) -- mostly missing license fields and undeclared tool usage
  • Command injection: 9 (15%) -- includes browser-use CLI injection and webapp-testing's shell=True subprocess
  • Unauthorized tool use: 6 (10%) -- tool restriction mismatches and undefined integration references
  • Prompt injection: 4 (6%) -- new category, all from LLM analyzer
  • Social engineering: 3 (5%) -- including canvas-design's instruction to overstate craftsmanship quality
  • Tool chaining abuse: 2 (3%) -- new category, YARA-based detection
  • Resource abuse: 2 (3%) -- infinite loops and missing referenced files
  • Hardcoded secrets: 1 (2%) -- clickup's exported API token

What's Next

The prompt injection findings are the most interesting signal from this expansion. They represent a threat class that's unique to AI agent skills -- traditional software doesn't have the concept of an LLM following instructions embedded in external content. As skill ecosystems grow, transitive trust and indirect prompt injection will likely become the dominant attack surface. We plan to expand coverage to additional registries and track how these patterns evolve.