Scan Before You Install assessed 1,587 public agent skills and reported forty-one distinct vulnerabilities under its analysis. Two composition demonstrations are particularly instructive. In one, a GitHub history reader and Slack interaction created a route for sensitive information to leave an agent’s workflow. In another, a watcher-style skill and OAuth…
Inspect the ClaimsCase · DiggingBeagle record
An agent-skill audit found risky skills and cross-skill paths to credential access
A research audit studied public skills and illustrated chains in which capabilities become dangerous when several skills interact.
Scope
Research audit and controlled demonstrations of agent skills; the 41 reported weaknesses do not represent 41 observed public incidents.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- mitigation available
- AI role
- AGAINST AI
Basis and provenance
The paper supplies controlled composition paths, not a field incident; vendor patches and an actual affected user population are unestablished. Impact remains unrated because the scoped record does not establish a calibrated severity-to-impact-band mapping.
Assessed Oct 31, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-C26-AGENT-SKILL-AUDIT-COMPOSITES-1 · Scan Before You Install: risks in public agent skills and combinations
At a glance
Forty-one scanner findings and the separate controlled compositions answer different questions; neither is a count of production victims.
Read the implicationsFalse-positive rates and prevalence of exploitable installed combinations are not established. The paper does not document actual victim token exfiltration from the studied composite chains.
Limits and uncertaintyFull account
Scan Before You Install assessed 1,587 public agent skills and reported forty-one distinct vulnerabilities under its analysis. Two composition demonstrations are particularly instructive. In one, a GitHub history reader and Slack interaction created a route for sensitive information to leave an agent’s workflow. In another, a watcher-style skill and OAuth gateway could combine into a bearer-token exposure path. The central unit is a capability composition, not a claim that every individual skill contains malicious source code.
The experimental chains should not be rewritten as confirmed production compromises. A skill reviewer must ask what data a skill can read, what destination another skill can write, and whether the agent’s orchestration can connect those two abilities across steps. Package-level scanning is useful but cannot by itself authorize the transitive effect of a whole installed set.
Mechanism and trust boundary
- 01
Step
- 02
Step
- 03
Step
Timeline
- Oct 30, 2026disclosure
Public disclosure
Claims & evidence
CLM-C26-AGENT-SKILL-AUDIT-COMPOSITES-1The authors report reviewing 1,587 public agent skills and identifying forty-one distinct vulnerabilities, with separate controlled skill-composition examples that expose cross-tool data flows.supported
Basis: reported finding
- supportsScan Before You Install: risks in public agent skills and combinationsprimary disclosure
Scan Before You Install paper, dataset audit and composite attack examples
Implications
Forty-one scanner findings and the separate controlled compositions answer different questions; neither is a count of production victims.
Controls and mitigations
- Evaluate the installed skill set as one permission graph; block cross-skill sensitive-data flows unless the effect is authorized and auditable.
Unknowns and contradictions
- False-positive rates and prevalence of exploitable installed combinations are not established.
- The paper does not document actual victim token exfiltration from the studied composite chains.
Sources and citation
Material revision history
- Oct 31, 2026 · Canonical change recorded · new in release · revision 208