An agent skill is a plain-text file of instructions telling a host agent how to do a job: which commands to run, which endpoints to call, which credentials to reach for. In the first half of 2026 the OpenClaw agent went viral and ClawHub, the public registry where people share skills for it, nearly doubled in a single quarter. Two researchers took frozen snapshots of the registry in March, June and July and asked a narrow question. A registry has only three kinds of signal to govern with. Its own metadata, whatever the community says about a listing, and whatever the automated scanners report. Is any of them worth anything?
Nearly every listing can say who published it. Almost none can say anyone read it. Owner metadata and an automated review status are close to universal. Community feedback is not: four in five listings carry neither a star nor a comment. Against that, 85% of the skills whose text could be read carried evidence of asking for at least one privileged capability, with shell execution and network access the commonest by far.
"The price of the party is paid after it ends: a registry-scale accumulation of privileged artifacts governed by signals whose meaning and validity were never established."
Which leaves the scanners. Three of them run over the registry: an LLM-based one, a static analyser, and VirusTotal. They disagreed on more than a third of the listings all three had covered. The researchers then had two experienced security reviewers label a sample by hand, blind to the scanner verdicts. The best of the three scanners found barely six in ten of the problems those reviewers confirmed, and about a quarter of the listings all three called clean were ones the reviewers thought warranted a human look. A flag, when it came at all, almost always meant "suspicious" rather than "malicious".
"No observed layer substitutes for another, because complete metadata is not review, a rule match is not runtime behavior, and scanner consensus is not correctness."
None of that is a measure of harm done. The privilege detector is a pattern match over a skill's text, recording that a file mentions a shell fence or a credential rather than that anything ever ran. The authors say plainly that whether such text translates into real behaviour needs a different study, with sandboxes and telemetry. The hand audit is small too: only a few hundred listings could be reproduced exactly enough to judge.
The result most likely to be over-read is the popularity one. The researchers also checked whether ordinary metadata, downloads and stars and version counts, predicted whether a listing was still there a month later. None of it held up, and the download signal pointed the other way once the age of a listing was accounted for. That is a narrow technical finding about which listings stay visible, not a claim that popular skills are bad ones. The more useful read is that a download counter records attention, and attention was never review.
All of which puts a pointed question to anyone whose company policy is some version of "engineers may install skills that are popular and scan clean". This study put a number on both halves of that sentence, and on this evidence neither carries the weight the sentence gives it. Treat a scan result as something that orders a review queue rather than something that opens a gate. Ask a vendor showing a single green badge which scanner produced it, what version it was, and how often it misses what a human would catch. A badge that collapses three disagreeing instruments into one word is hiding the disagreement, not resolving it. And there is a cheap internal control most organisations skip entirely: knowing which skills are actually installed on engineers' machines this week. A registry can only account for what it published. Your own estate is the part you can still govern.
Sources
- Xiong, Y., Zhang, T., "After the Party: Governing What a Viral Agent-Skill Ecosystem Left Behind" — https://arxiv.org/abs/2609.17274