Agent skill security: what we found scanning 104 skill repos and MCP servers
42.3% of the 104 agent skill repos and MCP servers we security-scanned (44 of 104) had at least one medium-or-higher automated finding; 10.6% (11) had a high or critical one. After the flagged lines were read by hand, 5 still need review and none were rejected.
This is original data from Agent Coach (Upskill), published by Avatar 8 LLC. Scans ran 2026-10-17 to 2026-10-22; numbers were computed from the scan output on 2026-10-25. Library figures are from the library build of 2026-10-25.
Headline numbers
| Measure | Count | Share |
|---|---|---|
| Repos and MCP servers scanned (the curated catalog) | 104 | 100% |
| Files read by the scanner | 51,475 | |
| Agent-facing files among them (SKILL.md, AGENTS.md, CLAUDE.md, prompts, rules) | 2,783 | |
| No finding at all | 46 | 44.2% |
| At least one medium-or-higher automated finding | 44 | 42.3% |
| At least one high or critical automated finding | 11 | 10.6% |
| Automated verdict: pass / review / reject | 83 / 18 / 3 | |
| Final verdict after reading flagged lines by hand: pass / review / reject | 99 / 5 / 0 |
What the scanner flagged, by type
A repo counts once per type, however many findings of that type it has.
| Finding type | Repos, medium or higher | Share | Repos, high or critical | Share |
|---|---|---|---|---|
| Prompt-injection text in agent-facing files (e.g. 'ignore previous instructions', hidden instructions, telling the agent to hide actions from its owner) | 9 | 8.7% | 4 | 3.8% |
| Credential or env read plus a network call in the same file (possible secret exfiltration) | 16 | 15.4% | 1 | 1% |
| Committed secret-like strings (gitleaks) | 18 | 17.3% | 0 | 0% |
| Known-vulnerable dependencies (osv-scanner) or install hooks / typosquats | 32 | 30.8% | 5 | 4.8% |
| Risky code patterns: pipe-to-shell, remote code exec, obfuscation, eval of decoded data | 10 | 9.6% | 5 | 4.8% |
Most medium findings were benign once read: test fixtures, documentation about attacks, public sample data, or the repo's own pinned lockfiles. That is why 18 automated "review" verdicts and 3 "reject" verdicts became 5 "review" and 0 "reject" after manual review. The automated numbers above are the raw signal; the final verdicts are what the library shows.
The wider library: 3,302 items
| Measure | Count | Share |
|---|---|---|
| Items listed (skills 1,387, MCP servers 868, repos 1,030, prompts 17) | 3,302 | 100% |
| Security-scanned (item or whole source repo) | 297 | 9% |
| Scan pass | 285 | 8.6% |
| Not yet scanned (listed for discovery only, labeled so) | 3,005 | 91% |
| Third-party items with no license file detected by GitHub | 324 of 3,276 | 9.9% |
| Third-party items whose license GitHub reports as NOASSERTION (unrecognized) | 259 of 3,276 | 7.9% |
| Third-party items with a permissive license (MIT, Apache-2.0, BSD, ISC, CC0, CC-BY) | 2,569 of 3,276 | 78.4% |
So 17.8% of third-party items in the index have no clear license, and 91% have not been scanned yet. Upskill shows full SKILL.md text only for scanned items with a permissive license.
Method
- What was scanned: the 104 skill repos, MCP servers and tools in the curated catalog the coach recommends from, each at a pinned commit (the commit is shown on every item page, for example https://upskill.coach/skills/agent-email-inbox).
- How: static analysis only; no candidate code was run. Custom rules for prompt injection (ignore-previous, role hijack, hidden instructions, telling the agent to conceal actions from its owner), credential reads combined with network calls, pipe-to-shell, remote exec, obfuscation and install hooks, plus semgrep, gitleaks and osv-scanner.
- Severity: findings in tests, fixtures, examples or defensive text ("never do X", detection rules) are lowered one level by the scanner before counting. "Medium or higher" counts what was left.
- Manual review: for repos with a non-pass automated verdict, the Upskill library agent read every high and critical finding line by line and sampled mediums by category (not an owner sign-off). The result is the final verdict shown in the library.
- License data: from the GitHub API on the date each item was fetched. "No license" means GitHub found no license file.
- Limits: a scan lowers risk; it does not prove safety. The catalog is curated, not a random sample, so these shares describe these 104 repos, not every skill on the internet. For a larger third-party sample see Snyk's ToxicSkills study.
Reuse
You may quote these numbers with a link to https://upskill.coach/research/agent-skill-security. Raw aggregates: https://upskill.coach/research/agent-skill-security.json. Questions: ops@avatar33.com.
Published 2026-10-25, updated 2026-10-25 by Avatar 8. Markdown copy: /research/agent-skill-security.md