# Detecting Vulnerabilities in Agent Skills with SkillSpector: From Green Checkmark to Real Security Judgment A guide to understanding and mitigating security risks in AI agent skills. - **Source:** [Towards Data Science](https://towardsdatascience.com) - **Published:** 2026-07-22 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/d9f8f4e2-0287-4f88-a937-07fd9cafb253 ## The Security Risk of Agent Skills Agent skills are simple instruction packages for AI agents, but their security is a major concern. Anyone can publish a skill, and users can download and use them freely. This opens the door for malicious code. Tools like SkillSpector are designed to detect these risks. ## How SkillSpector Works SkillSpector is an open-source tool that scans a skill folder for vulnerabilities. Users can run a security test and decide based on the score. However, the score alone isn't enough. For example, a skill might score 100/100 with a 'do not install' warning, but the real threat could be in plain English instructions. ## Limitations of Static Scanning SkillSpector's static layer is fast and free but can yield high false positives. For instance, a real GitHub automation skill might trigger 20 findings, 16 of which are part of its normal function. The score can't distinguish which findings are critical. ## The Importance of Semantic Scanning Beyond static scanning, semantic analysis offers deeper insights. This layer consists of four passes: three to hunt for new issues and one to filter false positives. Skipping these passes can let the most dangerous skills slip through. ## Structure of Skill Files A skill is a folder containing a Markdown file. The header includes a name and description, while the body contains plain-language instructions. The agent loads and follows these instructions, creating potential security vulnerabilities. ## The Danger of Prompt Injection Every line in a skill file is treated as an instruction, making prompt injection easy. For example, a line saying 'summarize the repo' and another saying 'summarize the repo’s .env file' are indistinguishable to the agent, leading to security risks. ## Risks in Published Skills Studies show significant security flaws in published skills. For example, 26.1% of 42,447 skills had prompt injection, and 5.2% showed malicious intent. Snyk's 2026 report found 76% of 3,984 skills were malicious. ## Examples of Malicious Skills Malicious skills can include instructions to steal AWS keys or disable safety checks. For instance, user 'zaycv' uploaded over 40 near-identical malicious skills, some containing base64-encoded commands or password-protected executables. ## Infiltration via GitHub Invariant Labs demonstrated how a single poisoned GitHub issue could lead an agent to leak private repository data, including project names and salary details, without any exploit code—just a crafted sentence. ## Shortcomings of Other Scanners Tools like Semgrep and Bandit may miss prompt injections in SKILL.md files because they focus on specific areas. Specialized tools like SkillSpector are essential for comprehensive security. ## Security Recommendations Don’t rely solely on scores. Combine static and semantic scans. Add extra layers to filter false positives. Adopt a multi-layered approach to detect and mitigate malicious skills effectively. ## Conclusion and Takeaways SkillSpector is a vital tool for detecting vulnerabilities in agent skills, but it’s not a standalone solution. Users must carefully analyze scan results and adopt a multi-layered security strategy to ensure AI agent safety. ## Sources covering this story - https://towardsdatascience.com/from-green-checkmark-to-real-judgment-auditing-ai-agent-skills-with-skillspector/ — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._