An AI agent skill can be more than a prompt: it may combine instructions that shape a model’s behavior with scripts, dependencies, or setup commands that act on a machine. Reviewing only the text misses one half of that supply chain; scanning only the code misses the other. Before installing a skill, inspect both surfaces, check who published it and where it came from, and limit what it can access. A scan can help find suspicious behavior, but it cannot prove a skill is safe.
Why an agent skill creates two security review problems
Skills are modular additions to an agent: they give it instructions for a task and may include files or steps that help carry it out. An empirical paper, Agent Skills in the Wild, describes skills as bundles of instructions and executable code. That description does not mean every skill contains code; it does mean that a reviewer should not assume a skill is only text.
As an Amazon Associate I earn from qualifying purchases.
The first inspection surface is what the model is told to do. Instructions can try to override safeguards, expose sensitive information, or steer the agent toward actions unrelated to the skill’s stated purpose. The second is what the surrounding material does: scripts can execute commands, dependencies can bring in additional code, and setup instructions can direct a user or agent to fetch and run files.
Recommended Free Tools
Those surfaces can interact. A skill’s instructions may prompt an agent to run a command or disclose a credential, while a script or dependency may perform technical actions independently of the model’s interpretation. Security review therefore has to consider the skill as a package, not just a block of natural-language text.
#1 Best Overall
What reported skill threats look like
Snyk’s reporting describes several kinds of risk in skills and their setup paths. The table connects those reported patterns to what a reviewer can inspect; it is a practical guide, not a claim that every skill contains these behaviors.
| Reported pattern | What to examine before installation |
|---|---|
| Prompt injection or instructions that attempt to override safeguards | Read the full instructions and linked content. Look for requests to reveal secrets, ignore prior constraints, or take actions beyond the skill’s stated purpose. |
| Credential theft or mishandling | Check whether the skill asks for credentials, reads secret-bearing files or environment variables, or sends sensitive data to a service. Do not provide production credentials to a skill that has not earned that access. |
| Data exfiltration | Inspect network destinations and any code or instructions that transmit files, prompts, environment data, or other information off the machine. |
| Malware installation or untrusted downloads | Review setup commands and scripts for opaque downloads, execution of fetched content, and requests for elevated privileges. |
| Typosquatted or otherwise suspicious packages | Check dependency names and their intended sources carefully; a familiar-looking name is not proof that it is the package the skill needs. |
These are reasons to inspect a package, not a checklist of behaviors that any single scanner will reliably detect.
What Snyk’s reported figures do—and do not—show
In its 2026 ToxicSkills post, Snyk said it analyzed 3,984 skills from ClawHub and skills.sh, with the corpus counted as of February 5, 2026. Snyk reported prompt-injection techniques in 36% of that corpus and 1,467 malicious payloads. These are Snyk’s figures for its stated corpus and analysis, not a universal rate for all skill marketplaces or a current count of skills available today. The payload count should not be read as a count of distinct malicious skills.
Free tools Windows power users keep installed
One-click scans. No signup required.
A separate empirical paper, Agent Skills in the Wild, uses its own dataset, taxonomy, and detection methods. Its measurements are not directly interchangeable with Snyk’s, so combining their percentages would create a misleading prevalence estimate. Taken together, these sources make a case for examining skills before installation; they do not establish that every marketplace or skill has the same risk.
Rank #3
How to vet an AI agent skill before installing it
Use a layered review. The steps below reduce avoidable exposure, but they are not a formal standard and cannot eliminate risk.
- Confirm provenance. Identify the publisher, source repository, and version you intend to install. Check that the project and publisher are consistent with the skill’s stated purpose. Popularity can provide context, but it is not evidence that a package is safe.
- Read the complete instructions and setup steps. Include linked files and any installation guidance, not just the marketplace summary. Note requests to reveal secrets, override safeguards, fetch remote content, or run commands that do not appear necessary for the skill’s function.
- Inspect the technical contents. Review scripts, dependencies, package names, requested permissions, and network destinations. Treat opaque downloads, unexplained network access, and elevated privileges as reasons to pause and investigate.
- Run a skill-aware scanner before installation. Choose a scanner that can inspect the source you actually have—such as a marketplace URL, repository, or local folder—and examine its findings rather than treating a pass/fail label as a verdict. Snyk documents those input options for its Agent Scan / Skill Inspector offering, and says it checks for risks including prompt injection, malware patterns, credential mishandling, and suspicious downloads. Those are vendor-described capabilities, not an independent evaluation of detection accuracy.
- Install with limited access and review changes. Grant only the permissions needed for the task, and avoid exposing production credentials. Tie the reviewed copy to the version you install where possible. Recheck changes and updates rather than treating an earlier scan as permanent clearance.
How to interpret a scanner’s result
A useful scan should make findings actionable: it should identify the suspicious instruction, file, dependency, or behavior so a reviewer can judge whether it fits the skill’s purpose. Coverage matters too. Check whether the tool examines both instructions and technical material, including scripts, dependencies, secrets, external links, and installation commands. A scanner that only reviews one surface leaves the other for manual review.
Also consider workflow and enforcement. A tool may accept a marketplace URL, repository, or local folder; that does not by itself mean it checks the exact version that will be installed, rescans updates, or can block installation under a policy. Confirm those details for the tool and workflow you use. OWASP’s living Agentic Skills Top 10 project frames skills as a distinct security risk area, but it is a community project, not a certification that a particular skill or scanner is safe.
No scan result is proof of trustworthiness. Detection can miss obfuscated or newly introduced behavior, and a finding can require context to distinguish a genuine threat from an action the skill needs. Provenance review, careful permissions, credential discipline, and scrutiny of updates remain necessary even when a scanner reports no issue.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
