6,309 Agent Skills Scanned: 70% Carry Elevated Capabilities, 59% Under-Declare
metanoai · hf · 2026-10-20
A paper from Metano Labs, Purdue, and VulNow presents a two-phase attack-surface profiling methodology for agent skills: whole-bundle static analysis with dependency provenance, followed by instrumented sandbox execution and model-based trace assessment.
Key findings from 6,309 marketplace listings:
- 50% carry shell-execution capability, 35% filesystem read, 31% each filesystem write and network egress, and 13% credential access — seven in ten skills hold at least one elevated capability, largely invisible at install time.
- The permission model is nearly inert: of 6,061 parseable frontmatters, only 770 declare anything, the vocabulary can't express credential access, and 59% of declaring listings understate what their bundle can do (ClawHub under-declares on 88% of its declarations vs 31% for skillsmp).
- Conclusion: marketplace triage must profile what a bundle can do, not what it declares, complementing maliciousness detection.
More from coding & agent
- Bots that should be skills: auditing a Grok Bot fleet with six tests — bfrench · 2026-10-20
- Dev's code review setup: agent diagrams before/after flows on a canvas for Q&A — max__drake · 2026-10-20
- Motion2Code: H3 Max designs motion, Claude Opus 5.5 rebuilds it as open-sourced GSAP HTML — OdinLovis · 2026-10-20
- Motion2Code open-sources agent skills that rebuild motion videos as SVG + GSAP code — OdinLovis · 2026-10-20
- tsrs: an agent-written Rust port of TypeScript is 8x faster than TS 7.0 with 70% less memory — cnakazawa · 2026-10-20
- ASCII Magic launches 634-piece MIT-licensed animated ASCII art library you can wire into coding agents — sull · 2026-10-20