The rapid expansion of tool-using AI agents has introduced new security considerations around the "skills" these systems consume at install time. A 2026 arXiv paper by researchers analyzing 6,309 agent-skill listings from two marketplaces reveals that the authority granted to agents at installation is far broader than most users realize, and that current marketplace triage mechanisms cannot reliably assess the true risk.
Installation grants authority, not just instructions
Agent skills are Markdown documents that a tool-using agent reads as instructions and then acts on with the privileges of the session that loaded them. Installing one grants authority — the standing to direct the agent, not new privilege — and the size of that grant is what the paper measures. The findings come from a two-phase attack-surface profiling methodology that combines whole-bundle static analysis and dependency provenance checking with instrumented sandbox execution and separate model-based assessment of the resulting traces.
What the surface actually looks like
The methodology was applied to 6,309 listings from two marketplaces, selecting listings for execution without conditioning that decision on a prior threat or risk signal. Half the corpus carries evidence of shell-execution capability. The corresponding shares for other capabilities are 35% for filesystem read, 31% each for filesystem write and network egress, and 13% for credential access. Seven listings in ten carry at least one elevated capability.
That is the surface a user accepts at install time, and almost none of it is visible then. A permission model exists but is close to inert. Authors may list the tools a skill pre-approves in its own frontmatter, which removes confirmation prompts rather than restricting what the skill can reach. Of the 6,061 listings whose frontmatter parses, 770 declare anything at all. The vocabulary cannot express credential or environment access, and nothing checks what it does express against the bundle.
Declaring is also not declaring accurately. Fifty-nine percent of declaring listings understate what their bundle can do. ClawHub declares roughly twice as often as skillsmp, yet under-declares on 88% of its declarations against 31%. Triage at the marketplace boundary therefore cannot rest on what a listing declares. It must rest on what the bundle can do.
Why the permission model falls short
The paper notes that a permission model already exists but is effectively inert. The frontmatter declaration system, intended to give users visibility into a skill's capabilities, instead serves only to remove confirmation prompts. The vocabulary available in frontmatter cannot express credential access or environment manipulation, and there is no mechanism to verify declared claims against the actual bundle contents. This means a listing may declare minimal permissions while the executed skill reaches far beyond those claims.
Implications for developers and teams
For teams building or deploying tool-using agents, the results suggest that reliance on marketplace-level triage based on declared permissions is insufficient. Attackers or careless authors can, and apparently do, understate the true capability scope of a skill. A skill that declares limited permissions may still execute filesystem writes, network egress, or credential access once installed. Any risk assessment must account for the actual bundle behavior, not the declared frontmatter.
The paper positions capability-oriented attack-surface profiling as a necessary complement to maliciousness detection. Rather than waiting to identify harmful intent after the fact, profilers can map the full operational surface a skill makes available, enabling more informed installation decisions and sandbox design.
Methodology overview
The two-phase approach first performs whole-bundle static analysis and dependency provenance checking to map the theoretical reach of a skill. This is followed by instrumented sandbox execution, where the skill runs in a controlled environment and traces of its actual actions are collected. A separate model-based assessment then processes those traces to categorize capabilities encountered during execution. The combination reveals what the skill can do in practice, independent of what its frontmatter claims.
The study examined listings from two marketplaces without conditioning execution selection on prior threat or risk signals, ensuring the profile reflects the full corpus rather than a pre-filtered subset.
- Half the corpus carries evidence of shell-execution capability
- 35%: filesystem read
- 31%: filesystem write
- 31%: network egress
- 13%: credential access
- Seven in ten listings carry at least one elevated capability
What this means for the broader landscape
As AI agents become more prevalent in development workflows, the gap between declared permissions and actual capability represents a significant blind spot. Teams that depend on agent skills from marketplaces should anticipate that the installed authority may exceed expectations based on the listing description. The findings also underscore the need for tooling that can dynamically profile skill behavior at install time, rather than relying on static declarations that are known to be incomplete and inaccurate.
The research was submitted to arXiv in October 2026 and categorizes under Computer Science > Cryptography and Security. Its central thesis — that triage at the marketplace boundary must rest on what the bundle can do, not what it declares — offers a concrete framework for rethinking how agent-skill risk is assessed and managed.