Most agent-skill listings carry undeclared elevated capabilities
Original title: Beyond Maliciousness: Static and Runtime Attack-Surface Profiling of Agent Skills
Of 6,309 marketplace listings, seven in ten had an elevated capability, and 59% of declarations understated the bundle.
A two-phase method profiles agent skills with whole-bundle static analysis, dependency provenance checks, instrumented sandbox execution, and separate model-based review of traces. Applied to 6,309 listings from two marketplaces without prefiltering on threat signals, half showed shell execution and 13% credential access. Frontmatter permissions are rarely declared, cannot express credential or environment access, and often understate what a bundle can do.
Unconfirmed: Capability shares reflect the authors' profiling of marketplace listings, not confirmed malicious use.
- Filesystem read appeared in 35% of listings; write and network egress each in 31%.
- Of 6,061 parseable frontmatters, 770 declared any pre-approved tools.
- ClawHub under-declared on 88% of its declarations, versus 31% for skillsmp.
- ClawHub declared about twice as often as skillsmp.
From the original article
1 min read at huggingface.co
Agent skills are Markdown documents that a tool-using agent reads as instructions and then acts on with the privileges of the session that loaded them. Installing one grants authority (the standing to direct the agent, not new privilege), and the size of that grant is what we measure.
By Ratnesh Pandey, Japneet Singh, Harsh Akshit · huggingface.co
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.