agent-skills: A Security-Audited npm Registry for AI Coding Agents — 13% of Marketplace Skills Have Critical Vulnerabilities

Forum topic · ✨步子哥 · 2026-09-13

Summary

agent-skills (https://github.com/tech-leads-club/agent-skills) is a TypeScript-based, security-first registry for AI coding agent skills, launched in response to research showing that 13% of marketplace skills contain critical vulnerabilities including path traversal, command injection, insecure deserialization, hardcoded credentials, and undeclared network access. The project argues that skills are executable supply chains, not static documents, since modern skills bundle Markdown instructions with scripts, configs, and binaries. It implements a six-layer defense architecture: 100% open source with no binaries, CI/CD static analysis (AST analysis, path traversal and command injection detection, secret scanning, network access auditing), immutable integrity via lockfiles and SHA-256 content hashes, runtime sandboxing with path isolation and audit logging, mandatory Snyk Agent Scan before publishing, and community reporting mechanisms. Skills are classified into three tiers with review rigor proportional to usage. A single skill runs across 15+ agents including Claude Code, Cursor, Copilot, Codex, Aider, and Cline. The project draws explicit parallels to npm's decade-long supply chain security evolution, aiming to build equivalent infrastructure early in the skill ecosystem's lifecycle.

Project Overview

Project: agent-skills
Repository: https://github.com/tech-leads-club/agent-skills
Website: https://skillsllm.com
Language: TypeScript
Positioning: A secure, verified, and tested skill registry for AI coding agents

The Problem: Skills Are Executable Prompts, Not Static Documents

Installing a Claude Code skill described as a "code review" tool could, without your knowledge, read your .env file, send your ~/.ssh directory listing to an external URL, add a postinstall script to package.json, and delete logs. This is not hypothetical — research by tech-leads-club found that 13% of marketplace skills contain critical vulnerabilities: path traversal, command injection, insecure deserialization, hardcoded credentials, and undeclared network access.

AI agent skills are repeating the supply chain problems npm faced (e.g., the 2018 event-stream hijack, the PyPI ctx SSH backdoor, cryptomining in Docker Hub images) — but faster, because skills are more of a black box: a Markdown file plus binary tools whose contents cannot be easily audited.

Modern skills typically include:

Markdown instructions
Executable scripts (Python, Bash, Node.js)
Config files (JSON/YAML, possibly referencing remote URLs)
Compiled binary tools
Dependency declarations (npm/pip/cargo)

The core insight: a skill is a supply chain, not documentation, and needs the same security infrastructure as npm packages, PyPI packages, and Docker images.

Six Layers of Defense-in-Depth

1. 100% open source, no binaries — every line auditable, CI/CD static analysis possible, community security patches accepted. 2. CI/CD static analysis — AST analysis for dangerous API calls (eval, exec, child_process), path traversal detection (../ patterns, path.join argument origins), command injection detection, hardcoded credential detection, and declared network access auditing (undeclared network access is flagged). 3. Immutable integrity — per-version lockfiles with exact dependency versions and hashes, SHA-256 content hashes verified at install time, atomic lockfiles resistant to man-in-the-middle tampering. 4. Runtime sandboxing — declared-path isolation, symlink escape guards, environment variable filtering, and audit logging of all file access, network requests, and subprocess calls. 5. Snyk Agent Scan (formerly mcp-scan) — mandatory pre-publication scanning against known vulnerability databases, malicious behavior patterns, and historical version diffs. 6. Community reporting and response — vulnerability reporting channels, automated takedown, CVE-style advisories.

Tier Classification

| Tier | Definition | Review level | Examples | |---|---|---|---| | Tier 1 | Core tools, high usage | Manual review + automated scanning + penetration testing | Code formatting, lint | | Tier 2 | General tools, moderate usage | Automated scanning + community review | API doc generation, test runners | | Tier 3 | Experimental, low usage | Automated scanning | New framework integrations, personal tools |

This addresses a key npm lesson: core packages with millions of dependents received the same review rigor as personal toys.

Cross-Agent Compatibility: One Skill, 15+ Agents

Supported agents include Claude Code, Cursor, Aider, Cline, Windsurf, OpenAI Codex, Antigravity, Kilo Code, OpenCode, Roo Code, Kiro, Droid (Factory.ai), GitHub Copilot, Amazon Q, Augment, Sourcegraph Cody, and Tabnine.

Using TypeScript type definitions and strict schema validation, agent-skills standardizes across harnesses — reducing developer maintenance cost and improving auditability: audit once, run everywhere.

Why Now

Three converging trends make this urgent:

1. Agent usage explosion — monthly active users of Claude Code, Cursor, and Copilot grew from millions in 2025 to hundreds of millions in 2026, expanding the attack surface from developers to all knowledge workers. 2. Skill complexity growth — skills now call APIs, write files, run subprocesses, and access networks, but security infrastructure remains Markdown-era. 3. Mature supply chain attack playbooks — proven npm/PyPI/Docker attack techniques (review bypass, time-gap attacks, dependency chain exploitation) transfer directly to skills.

Mapping to npm's Security Evolution

| npm ecosystem | agent-skills | |---|---| | package-lock.json | Lockfile + content hashes | | npm audit | Snyk Agent Scan | | npm publish | CI/CD static analysis + manual review | | package.json scripts | Runtime sandbox + audit logs | | CVE database | Malicious behavior pattern database | | npm install --ignore-scripts | Path isolation + environment variable filtering |

npm took 10 years to build its current supply chain security infrastructure. agent-skills aims to build it early in the skill ecosystem's lifecycle — before attackers arrive at scale and before the ecosystem grows beyond manageable review capacity.

TL;DR

agent-skills is a secure skill registry for AI coding agents — 100% open source, six-layer defense, tiered review, cross-compatible with 15+ agents. It brings npm's decade of supply chain security infrastructure into the skill ecosystem at its earliest stage.