Seven in ten agent skills carry an elevated capability, and 59% of those that declare permissions understate them, a 6,309-listing scan finds
A preprint profiling skillsmp and ClawHub finds shell access in about half of listings and credential access in 13%. The scanner's maker wrote the paper and has not released the data.
Half the corpus carries evidence of shell-execution capability; the corresponding shares are 35% for filesystem read, 31% each for filesystem write and network egress, and 13% for credential access; seven listings in ten carry at least one elevated capability.
Comprehensive take
Do not install community skills on the strength of their declared permissions. Treat shell, network and credential reach as the default, read the bundled scripts, and sandbox anything unfamiliar. Hold the exact percentages loosely until someone independent reproduces them.
Use cases
Vetting a skill before install
Check scripts, piped installers and unpinned dependencies rather than the frontmatter allowed-tools list.
Running a skill marketplace
Add capability profiling next to maliciousness detection, since exposure often exists without malicious intent.
Sandboxing agent sessions
Run unfamiliar skills in sessions that hold no credentials, because the skill inherits the session's privileges.
Specs
| Corpus | 6,309 listings, 2,392 publishers: skillsmp 3,947, ClawHub 2,362; scanned Jul 28 to Aug 25, 2026 source |
|---|---|
| Capability shares | Shell ~50%; fs read 35%; fs write 31%; network egress 31%; credential access 13% source |
| Elevated capability | Seven in ten listings carry at least one source |
| Declarations | 770 of 6,061 parsed listings declare anything; 59% of those understate source |
| Under-declaration by marketplace | ClawHub 88% of declarations; skillsmp 31% source |
| Human review | 410 listings adjudicated, 91 flagged, one marketplace, in progress source |
Insights
- Axion reading: the strongest claim is structural, that the permission field is a pre-approval and not a restriction; that holds regardless of the percentages.
- Axion caution: every rate comes from the authors' own proprietary scanner, with no independent validation and no released data.
The finding
A new arXiv preprint profiles 6,309 agent-skill listings from two marketplaces, skillsmp (3,947) and ClawHub (2,362), from 2,392 publishers, scanned between July 28 and August 25, 2026. An agent skill is a Markdown SKILL.md plus any scripts it ships; installing one means the agent follows its instructions and runs its scripts with whatever shell, filesystem, network and credentials the session already has. The paper's question is not "is this skill malicious" but "what could it do".
Its answer: about half of the corpus shows evidence of shell-execution capability, 35% filesystem read, 31% each filesystem write and network egress, and 13% credential access. Seven listings in ten carry at least one elevated capability. The authors stress that substantial capability exposure frequently exists without measured malicious intent, so this is a statement about attack surface, not about attackers.
The permission field is a grant, not a fence
The Agent Skills specification the paper cites lets an author list pre-approved tools in frontmatter. The paper's point is that this removes confirmation prompts rather than restricting reach, it is written by the same author as the skill, and nothing checks it against the bundle. Of 6,061 listings whose frontmatter parses, only 770 declare anything, the vocabulary cannot express credential or environment access, and 59% of declaring listings understate what their bundle can do. ClawHub declares about twice as often as skillsmp, yet under-declares on 88% of its declarations against 31% on skillsmp.
That matters for how you triage. If you review skills by reading the declared permissions, the paper says that is the weakest signal available. Read the scripts, look for piped installers and unpinned dependencies, and run unfamiliar skills in a sandbox with no credentials.
How far to trust the numbers
The caveats are unusually prominent, to the authors' credit. The scanner behind every rate is built and operated by Metano Labs, no third party evaluated it, and no external ground truth was available. The human adjudication tier covers 410 listings (91 flagged), is drawn from one marketplace, and was still in progress at the time of measurement. The raw scan reports, bundles and production implementation are not released, so the results cannot be independently reconstructed from what is offered.
The sample is also not the marketplace. It deliberately skips the most popular head and the unused tail, popularity is measured differently on each site (stars versus downloads), and publisher concentration is uneven: the largest single publisher contributes 266 listings, and on skillsmp a publisher averages 4.1 listings, so those rates are closer to per-publisher than per-skill.
What to do with it
For anyone installing community skills, the practical takeaway does not depend on the exact percentages: shell, network and credential access are common, and declared permissions are not a reliable guide. For marketplace operators, the paper argues for capability-oriented profiling alongside maliciousness detection. For researchers, the missing piece is a released dataset and an independent scanner to replicate the 59% understatement figure.