研究揭示：AI Agent技能仅12%经过安全审计，覆盖83%安装量

Security audits of AI agent skills go where the installs are: the audited 12.2% of listings holds 83.3% of all installs, and the other 70,090 listings have no published review at all.

That is the core finding of the Agent Skill Security Census, a frozen-edition study published this week. Disclosure: I run Skillselion, the independent directory behind the census. It is not affiliated with Anthropic, OpenAI, or Cursor. Every number below is frozen to August 12, 2026, and you can re-derive all of it from the CSV linked on the census page.

Why this week, of all weeks

Agent security stopped being theoretical this month. At Black Hat USA 2026 on August 5, researchers from Novee Security showed that an unprivileged GitHub issue could reach CI runner secrets in the vendors' own repositories for Claude Code and Gemini CLI, and on OpenAI's Codex repository could hijack the next agent run. The Claude Code flaw, CVE-2026-54316, abused Hugging Face's public download counter as a covert channel, leaking an API key character by character. It was fixed in Claude Code 2.1.163. The Gemini CLI bug scored a perfect CVSS 10.0.

In the same stretch, the Claude Code v2.1.228 release hardened skills synced from claude.ai: synced skills can no longer shadow local commands or MCP prompts, their descriptions are sanitized and labeled, and their bodies no longer run ! commands or expand @ files on your machine.

Vendors patched the harnesses this month. Nobody had measured the skill ecosystem itself, so we did.

What the census counted

The census is a complete dump of the Skillselion production catalog taken on August 12, 2026: 79,848 listings and 164,841,042 cumulative installs, drawn from a live catalog refreshed daily from skills.sh, GitHub and MCP registries, ranked by real installs. On top of that catalog sit 41,791 audit verdicts published by 5 independent providers: Socket, Snyk, Gen Agent Trust Hub, ZeroLeaks and Runlayer. The census counts each listing's worst verdict as its risk level and never re-scores anything itself.

For the market-shape numbers behind the same catalog, the companion Agent Economy Census is the place to look, and the live-updating totals live in The State of AI Agent Skills 2026.

Audits follow installs, almost nowhere else

9,758 listings, 12.2% of the census, carry at least one audit. That thin slice holds 137,238,408 installs, which is 83.3% of every install counted. The median audited listing has about 1,700 installs. The median unaudited one has 7.

Auditors triage by popularity. That is rational, and it genuinely protects the crowd: five out of six installs land on code somebody has reviewed. It also means 70,090 listings sit in the dark, and the census puts it bluntly: "If you install from the long tail, you are the review."

More than half of audited skills carry flags

Take the worst verdict each audited listing received and 55.7% land at MEDIUM or above. 1,346 listings are flagged HIGH or CRITICAL, and together they hold 15,221,597 installs. 1,366 listings, 14.0% of everything audited, fail at least one provider's audit outright.

A flag records capability and findings: shell execution, browser control, network reach. The census is explicit that a flag is never an accusation of malice, and the next section shows why that distinction matters.

The flagged list includes every major vendor

The most striking table in the study is who shows up flagged. These are per-listing public verdicts, visible on each listing page:

By publisher, ByteDance Lark leads flagged install mass with 9 flagged listings and 2,440,132 installs, ahead of Microsoft (14 flagged listings, 1,153,302 installs), Vercel (24, 731,729), Anthropic (13, 577,993), Google (11, 94,343) and OpenAI (12, 50,785).

Read those flags correctly. A CRITICAL on azure-validate describes what a deploy-validation tool can reach, and a HIGH on a browser driver tracks the fact that it drives a browser. Risk in this ecosystem concentrates in the most useful, most installed code, whoever publishes it. That is exactly why "big vendor" is a poor proxy for "nothing to review."

What to do before you install a skill

Concrete steps that follow from the data, frozen date and all:

Check the listing's audit verdicts first. 99.6% of audited listings carry verdicts from at least two providers, so a popular skill with zero verdicts is a signal in itself. Start from the security category or the full skills catalog.

Read declared permissions. Shell plus network in one skill means code that can both execute commands and phone out. The census found 2,754 such listings carrying 51,755,286 installs.

Treat an unaudited long-tail skill as unreviewed code, because that is what it is. The median unaudited listing has 7 installs; nobody went before you.

If your agent loads skills at runtime over MCP, the same questions apply to the server you connect.

Unfamiliar with the audit vocabulary? The glossary covers the terms the verdicts use.

Reproduce it yourself

The full dataset, 79,848 rows with per-provider verdicts, worst risk level, declared permissions and installs, is downloadable from the census page under CC BY 4.0 (1.8 MB gzipped). Cite it as "Skillselion Agent Skill Security Census, August 2026". The methodology section on the page spells out the limits, including that declared permissions are documentation claims rather than sandbox measurements.

The week's CVEs got patched. The 70,090 unreviewed listings are still there, and they will still be there next week. Knowing which side of the 12.2% line a skill sits on takes about ten seconds. After this week, it seems worth the ten seconds.