Only 17.7% of the catalog is popular enough to be graded, 1 in 32 graded skills is unsafe, and the...
Security audit of 117K AI agent skills: 17.7% graded for safety, 1 in 32 unsafe; 97K remain unaudited. Agent-native attacks emerge—skills stealing agent config and memory—requiring governance rethinking at scale.
Only 17.7% of the catalog is popular enough to be graded, 1 in 32 graded skills is unsafe, and the risk lives in the long tail — plus a new agent-native attack surface.
We Security-Graded 117,854 AI Agent Skills. Here's What We Found. | Agent Skills Hub
Only 17.7% are popular enough to be graded. Among graded skills, 1 in 32 is unsafe. The risk lives in the long tail.
agentskillshub.top
The uncomfortable part isn't the skills that are unsafe. It's how few have been checked at all.
A fake AI agent skill passed every security scanner and reportedly reached 26,000 agents
Fake AI Agent Skill Passed Security Scans and Reportedly Reached 26,000 Agents
NVIDIA SkillSpector Guide: Scanning AI Skills for Security Risks with Static Analysis and SARIF Reports
Security scanners only check what's in the package. Malicious actors are exploiting that narrow view with mutable external links…
Security firm AIR built a harmless fake skill, got it past Cisco and NVIDIA scanners, and says it reached 26,000 agents, exposing…
The AI Risk Quadrant categorizes 100 agents according to how easily they can be compromised, size of potential blast radius, and…
AIR says its fake AI skill passed scanner checks by using a mutable external link, exposing a blind spot in agent skill vetting.
I ran skillscore on all 24 skills from addyosmani/agent-skills to find what separates a 91/A from a 77/C. Two patterns showed up…
TL;DR what: Security firm AIR planted a fake skill named brand-landingpage that passed...
