What’s inside 6,726 agent skills
The scariest flags were false alarms. The risk is elsewhere.
| Measure | Count |
|---|---|
| Skills scanned | 6,726 |
| With at least one flag | 1,756 |
| With a high-risk flag | 198 |
| Repos those 198 come from | 37 |
| Of those, in the top five repos | 113 |
The alarming flags were defenders
28 skills contain “ignore previous instructions”. I read all 39 lines. Every one quotes the attack to block it, test for it or teach it.
8 contain hidden Unicode. Seven are code that strips it, plus its tests. The eighth nests a code fence with a zero-width space.
A pattern cannot tell an attack from a description of one. So skillscout blocks and asks you to read; it never calls a skill malicious.
The real exposure is install steps
134 of the 198 are high only because of sudo or a download piped into a shell: apt-get install, an installer from astral.sh or rustup.
Ordinary in a README. In a skill, your agent runs them with your permissions, from a URL that can change after you read it.
Skills that act without asking
9 skills tell the agent to skip you: deploy on a timeout, kill browser processes and retry, file a bug without review, gather data quietly. None is hostile. Each removes a check you might want.
Attack payloads, shipped as skills
41 of the 198 sit in two offensive-security and CTF packs. They carry working payloads verbatim, such as a shell-profile line that fetches a stager.
Right for a pentest. Risky as a skill your agent can load in any session.
Method and limits
Pattern rules over every file, at the commit that was scanned. Nothing was executed and nothing was judged by a model. Counts are from one run; the weekly index has since grown to 32,360 skills from 1,173 repos.
pipx install skillscout-cli
skillscout init
skillscout discover --full