I scanned 50 popular skills from GitHub. 19 of them had security issues.

After the ClawHub shutdown I got paranoid about what I was installing, so I built an automated scanner and started running popular GitHub skills through it.

I pulled 50 skills with the most stars and forks from the main aggregator sites. Ran each one through 8 checks: dangerous command patterns, hardcoded secrets, env variable harvesting, network access, obfuscation, prompt injection, file type screening, and structure validation.

Results:

31 passed clean. No issues.

12 had warnings. Things like env variable reads near network calls, broad file system access patterns, or outbound URLs that aren't clearly documented. Not necessarily malicious but worth knowing about before you install.

7 had at least one failure. Two had hardcoded API key patterns (probably left in by accident, but still). One had a curl piped to sh in a helper script. One had eval() with string concatenation that looked like it was trying to obfuscate what it was doing. Three had prompt injection patterns, instructions telling the agent to suppress output or avoid telling the user what it was doing.

I'm not going to name the specific skills because some of these are probably accidental, not malicious. But the point stands: nearly 40% of what I scanned had something worth flagging.

For context, these aren't random repos with 0 stars. These are skills people are actually installing. Some have hundreds of installs.

What I've been doing since:

I run every skill through the scanner before installing. It takes about 10 seconds. The scanner checks file structure, file types, dangerous shell commands (rm -rf, fork bombs, pipe-to-shell), secrets patterns (API keys, private key headers), env harvesting, network access, obfuscation (base64 blobs, eval chains), and prompt injection (instructions to hide actions, ignore guidelines, exfiltrate data).

I also built this into agensi.io, every skill uploaded there gets scanned automatically before it goes live. But honestly even if you never use Agensi, you should be scanning skills yourself before installing them. Repello has a free scanner. AgentShield does deeper analysis. Or just grep for the obvious stuff: eval(), curl|sh, base64 -d, os.system(), and anything referencing your env vars near a fetch call.

The Snyk ToxicSkills audit found similar numbers at scale. This isn't a theoretical problem anymore.

What are you all doing? Scanning before install, reading line by line, or just trusting stars?