Beyond Maliciousness: Static and Runtime Attack-Surface Profiling of Agent Skills
70% of 6,309 scanned agent-skill marketplace listings carry an elevated capability like shell exec or credential access…
Researchers built a static-and-runtime profiling pipeline and ran it against 6,309 agent-skill listings (Markdown instruction bundles an agent executes with session privileges) from two marketplaces. They found broad, often undeclared access to shell execution, filesystem and network, and showed the marketplaces' own permission-declaration system is sparse, can't express key risk categories, and is frequently inaccurate even when used.
Why it matters
Agent skills are becoming a packaging format for giving coding agents new abilities, and this study shows the installed base already carries broad, largely invisible privilege — shell execution, filesystem access, network egress, even credential access — with a declaration system too thin and inaccurate to be trusted as a safety signal. That reframes marketplace trust for any team installing third-party skills into an agent session.
What is verified
Researchers applied a two-phase static and runtime attack-surface profiling methodology to 6,309 agent-skill listings from two marketplaces, selecting listings for execution without conditioning on prior threat signals. [1]
Half the corpus showed evidence of shell-execution capability; 35% showed filesystem read, 31% each filesystem write and network egress, and 13% credential access; seven in ten listings carried at least one elevated capability. [1]
Of 6,061 listings whose frontmatter parsed, only 770 declared any tool permissions at all, and the declaration vocabulary cannot express credential or environment access. [1]
59% of listings that did declare permissions understated what their bundle could actually do; ClawHub declared roughly twice as often as skillsmp but under-declared on 88% of its declarations versus 31% for skillsmp. [1]
What is not
- The paper does not name the two marketplaces' total user base or installs, so real-world exposure (how many agents/users actually ran these skills) is unknown.
- No information on whether marketplace operators (ClawHub, skillsmp) have been notified or have remediated the permission-model gaps.
- The paper does not state what specific malicious or harmful outcomes, if any, occurred from the elevated capabilities found; it measures attack surface, not confirmed exploitation.
- No peer review status beyond arXiv submission is given.
Sources
- 1arXiv cs.LGarxiv.org · Primary source
Original source published 14 October 2026 at 00:34.
An AI-assisted briefing by Coding Partners. We link the evidence behind the reporting so you can explore the original work and assess the claims. How CP Signal works.