Research · Updated October 22, 2026

Are agent skills safe?

Mostly, if you get them from a source you can read. We scan every file in 1,982 Claude, Codex and Cursor skills from 42 GitHub repositories each week. 96.4% came back clear, 56 need a quick read, and 16 contain a pattern worth reading before you install. When we read the 16 flagged skills by hand, none of them was trying to harm the user. Open marketplaces have been a different story.

Scanned 1,982Clear 1,910Needs review 56Flagged 16

By Tineessa Nelson, Use This Skill. Counts update with each weekly scan; the hand review is dated October 22, 2026.

What the scan found

Which risky patterns show up

Each rule is a pattern a skill should rarely need. A flag means read the file before installing; review means the pattern is often legitimate, so read the line. A skill can match more than one rule.

Pattern	Level	Skills
Downloads and runs code in one step	flag	15
Destructive command on the system or home folder	flag	2
Sends data to an outside endpoint	flag	1
Asks for elevated privileges	review	33
Mentions credential files or secrets	review	31
Rules-override phrasing	review	5
Installs something that runs later	review	5
Rewrites shared git history	review	2

Source: the Use This Skill weekly scan, October 22, 2026. The nine rules and their exact patterns are on how the safety scan works.

Read by hand

What the flagged skills actually do

A pattern match is not a verdict, so we opened every flagged file on October 22, 2026.

What the flagged line turned out to be	Skills
An official installer piped into a shell (uv, rustup, Sentry CLI and similar)	12
A security guide quoting the pattern as a warning	3
A placeholder webhook address in documentation	1
An attempt to harm the user	0

Installer one-liners are normal for command-line tools, and they still run whatever the server sends at that moment. If a skill tells your agent to run one, check the address is the tool maker’s own domain, or install the tool yourself first.

Why the source matters

Open marketplaces are riskier

Our directory is built from known GitHub repositories, which is why the results above are so clean. Open marketplaces that accept uploads from anyone have been targeted. In February 2026, Koi Security found 341 malicious skills among the 2,857 then listed on ClawHub, the OpenClaw marketplace, most of them part of one campaign that delivered a password stealer through fake setup steps. The count later passed 800 as the marketplace grew, according to a July 2026 research note from the Cloud Security Alliance.

The difference is not that one kind of skill is safe. It is that a skill from a repository you can read, with a history and an owner, is far easier to check than an anonymous upload.

Before you install

How to check a skill in two minutes

Read SKILL.md. It is plain text. Every instruction in it is something your agent will do with your permissions.
Look for scripts. Any shell, Python or JavaScript file can do more than the description says. Read what it sends and where.
Search for one-line installers that pipe a download into a shell, and for anything that reads ~/.ssh, cloud credentials or .env files.
Check the owner and the license. A known author, a commit history and an open license are good signs; a new account with one upload is not.
Run a scan. Paste any GitHub link into the free skill check, or let a connected agent call check_skill before it installs anything.

How we got this

Method and limits

Every week the crawler collects each skill folder from 42 public GitHub repositories and scans every text file against nine regular-expression rules. Results for each skill, with the file, line and matched text, are on its page in the directory. On October 22, 2026 we read every flagged file by hand and sorted it into the categories above.

A static scan cannot run a skill or see what a model will do with its instructions, and a determined author can hide things from pattern matching. A clear result means none of the nine patterns appeared, nothing more. The directory covers repositories we chose to crawl, so it is not a random sample of every skill in existence.