Research · data from 30 October 2026
Agent skills safety, October 2026
4,675 public agent skills scanned. 1 in 10 carries a finding; 1 in 25 contains text telling the agent to set aside its instructions, hide what it does or switch off a safety check.
Key findings
of public agent skills have a clean scan: no rule matched any file.
carries at least one finding (50 of 500); 30 high-severity findings across them.
contains text that tells the agent to set aside its instructions, hide what it does from the user, or switch off a safety check (20 of 500).
grade D or F: a critical pattern such as invisible Unicode or decode-then-execute, or several high findings together.
Skills are instructions, so the risk is different from servers. A server with an open endpoint can be abused by a stranger; a skill with an injection line is abused the moment the agent reads it. The good news is that most skills are a single Markdown file that does what it says. The bad news is that the ones that are not look identical from the outside.
Grades
- AGrade A463 · 93%
- CGrade C (one high finding)30 · 6%
- DGrade D4 · 0.8%
- FGrade F (critical)3 · 0.6%
There is no B in practice: a skill is either clean or has lost 30 points to one high finding. 13 of the 463 A-grade skills lost a point or two for an over-long description and nothing else.
What the findings are
| Finding | Skills in sample | Share of all skills |
|---|---|---|
| Tells the agent to ignore instructions, hide its actions or disable a safety check | 20 | 4.0% |
| Downloads a script and runs it in one step (curl | sh) | 4 | 0.8% |
| Reads credential files (.ssh, cloud credentials, keychains) in a script | 4 | 0.8% |
| Sends data to a throwaway collection endpoint (request bins, tunnels) | 3 | 0.6% |
The injection row is the one that matters and the one most open to interpretation. It catches a skill that says "ignore all previous instructions and…" in its own voice, and it also catches a skill that converts documents and warns, correctly, that documents may contain such text. Each flagged line is shown with its file and line number on the skill's page so a reader can tell which is which in a few seconds. Some of the flagged lines in this sample are the second kind: security tooling, red-team skills and conversion tools quoting the attack they defend against. We publish the line rather than a verdict for exactly that reason.
The remaining three rows are less ambiguous. A skill that pipes a download to a shell, reads ~/.ssh or posts to an ngrok URL is doing something a user should see before installing, whatever the intent.
What a skill looks like
- One file (SKILL.md only)248 · 50%
- Two to four files136 · 27%
- Five files or more116 · 23%
Half of public skills are a single Markdown file; a quarter are small toolkits of five files or more, with scripts, references and templates. Findings concentrate in the larger ones, because scripts and reference documents are where shell commands and example payloads live. A one-file skill is easy to read in full before installing; a fifteen-file skill is not, which is the case for scanning them.
In context
Anthropic launched Agent Skills in October 2025 and opened the format as a standard in December; it joined the Linux Foundation's Agentic AI Foundation in October 2026. Vercel's skills.sh counted a million published skills and around 280 million installs by September 2026, with half of skills installed exactly once. Snyk's February 2026 ToxicSkills study of 3,984 skills on ClawHub found prompt-injection text in 2.6% of skills overall and in 91% of the 76 it confirmed malicious; it found 13.4% with at least one critical issue. Our 4.0% rate of injection-style text on GitHub-hosted skills is of the same order (ours counts defensive quotations too), and our D/F rate (1.4%) is lower than ClawHub's critical rate, which is what you would expect from skills published under a developer's own GitHub account rather than an anonymous marketplace.
What to do
- Read
SKILL.mdbefore installing, the whole thing. If the skill has scripts, read those too, or install only skills whose page shows a clean scan. - Treat "ignore previous instructions" in a skill the way you would treat it in an email: as the point of the file, not a detail.
- Prefer skills with a named author and a public repository with history. A skill is a text file; anyone can publish one in a minute.
- If you publish skills, run skill-scan before you push. It is the same rule set and takes a second.
Method and limits
- What a skill is. A folder with a
SKILL.mdthat an agent (Claude Code, Codex, Cursor and others) reads as instructions when a task matches its description. Unlike an MCP server it is not code the agent calls; it is text the agent obeys, plus any scripts the folder ships. - Population. 4,675 public skills on MCP Market on 30 October 2026, found by GitHub search (topics
claude-skills,agent-skills,claude-code-skillsand similar) plus Anthropic's own repository, each graded by a content scan of every text file in the folder. Skills on ClawHub or skills.sh that are not on GitHub are not included. - Sample. 500 of the 4,675 drawn uniformly at random and read from their public pages; proportions are within ±4.4 points of the population 95 times in 100.
- Rules. The scan reads text, never runs anything. Critical (an F): invisible Unicode tags, decode-then-execute. High (−30): download-and-run installers, credential-file reads in scripts, data sent to throwaway collection endpoints, environment exfiltration, "ignore your instructions" or "without telling the user" phrasing,
rm -rf ~. Medium −10. An over-long name or description −3. The same rules are open source as skill-scan. - Limits. A finding is a line that matches a rule, shown with the file and line on the skill's page. A security tool that quotes an injection phrase to detect it will match; so will a document-conversion skill that warns about injected documents. The counts are of text patterns, not confirmed attacks.
Use this data
Quote any number on this page with a link back to it. Suggested citation: MCP Market, "Agent skills safety, October 2026", mcp.market/research/agent-skills-safety-october-2026.
Journalists and researchers: the row-level sample behind this edition (CSV, no personal data) and cuts by category, publisher or transport are available on request from hello@mcp.market, usually the same day. We will also re-run any number on the current catalogue.
Earlier editions: all research.