agent-skills: A Security-Audited npm for AI Coding Agents — 13% of Marketplace Skills Have Critical Vulnerabilities

Forum topic · ✨步子哥 · 2026-09-13

Summary

agent-skills (https://github.com/tech-leads-club/agent-skills) is a security-first registry of AI coding agent skills, written in TypeScript. The project's research claims that 13% of marketplace skills contain critical vulnerabilities, including path traversal, command injection, insecure deserialization, hardcoded credentials, and undeclared network access. The core argument is that agent skills are executable software forming a supply chain, not static documentation: modern skills include scripts, config files, binaries, and dependencies. agent-skills addresses this with a six-layer defense: 100% open source with no binaries, CI/CD static analysis (AST checks, path traversal and command injection detection, credential scanning, network access audits), immutable integrity via lockfiles and SHA-256 content hashes, runtime sandboxing with path isolation and audit logs, Snyk Agent Scan before publishing, and community reporting. Skills are tiered by usage (Tier 1 gets manual review and penetration testing), and the registry supports 15+ agents including Claude Code, Cursor, GitHub Copilot, Aider, and OpenAI Codex. The article draws a direct analogy to npm's decade-long supply chain security evolution, arguing these defenses must be built early before large-scale attacks arrive.

agent-skills: A Security-Audited npm for AI Coding Agents

Repository: https://github.com/tech-leads-club/agent-skills Website: https://skillsllm.com Language: TypeScript Positioning: A secure, verified, and tested skill registry for AI coding agents

The problem: you installed a skill — what did it actually do?

Suppose you install a "code review" skill in Claude Code that promises automated PR review. In reality it could read your .env file, exfiltrate your ~/.ssh directory listing to an external URL, add a postinstall script to your package.json, and delete logs — all without your knowledge. A polished README with screenshots and stars tells you nothing about actual behavior.

This is not hypothetical. Research by tech-leads-club found that 13% of marketplace skills contain critical vulnerabilities — path traversal, command injection, insecure deserialization, hardcoded credentials, and undeclared network access.

The ecosystem is repeating npm's history, and faster. npm saw the event-stream incident in 2018 (malicious takeover injecting crypto-wallet-stealing code), PyPI's ctx package with an SSH backdoor, and cryptomining in official Docker Hub images. But skills are even more opaque than npm packages: they're often a Markdown file plus a binary tool, and you don't know what's inside the binary.

Core insight: a skill is an executable prompt, not static documentation

Modern skills typically contain:

Markdown instructions telling the agent what to do
Executable scripts (Python, Bash, Node.js)
Config files (JSON/YAML, possibly referencing remote URLs)
Binary tools (compiled executables)
Dependency declarations (npm/pip/cargo)

The Markdown is readable — but the scripts and binaries are not. A skill is a supply chain, not documentation, and it needs the same supply chain security infrastructure as npm packages, PyPI packages, and Docker images.

Six layers of defense in depth

1. 100% open source, no binaries

event-stream

2. CI/CD static analysis

AST analysis of dangerous API calls (eval, exec, child_process)
Path traversal detection (../ patterns, path.join argument sources)
Command injection detection (shell arguments derived from user input)
Hardcoded credentials (API keys, tokens, passwords)
Network access audit — all external URLs must be declared; undeclared access is flagged

3. Immutable integrity

Lockfiles recording exact dependency versions and hashes per skill version
SHA-256 content hashes verified at install time
Atomic lockfiles resistant to man-in-the-middle tampering

4. Runtime sandbox

Path isolation: skills access only declared paths
Symlink guards against sandbox escapes
Environment variable filtering: skills see only declared variables
Audit logs of all file access, network requests, and subprocess calls

5. Snyk Agent Scan (formerly mcp-scan)

Mandatory pre-publication scanning: known vulnerability database matching, malicious behavior pattern matching, and diff analysis against historical versions.

6. Community reporting and response

Security report channels, automatic takedown mechanisms, and a CVE-like advisory system.

Tier-based grading

| Tier | Definition | Review level | Examples | |---|---|---|---| | Tier 1 | Core tools, high usage | Manual review + automated scanning + penetration testing | Code formatting, linting | | Tier 2 | General tools, medium usage | Automated scanning + community review | API docs generation, test runners | | Tier 3 | Experimental, low usage | Automated scanning | New framework integrations, personal tools |

npm's lesson is that treating all packages identically means core packages relied on by millions get the same scrutiny as personal toy packages. Tier 1's manual review and penetration testing takes "core infrastructure" seriously; Tier 3's lighter review is a reasonable tradeoff for experimental tools.

Cross-agent compatibility: one skill, 15+ agents

| Mainstream | Emerging | Enterprise | |---|---|---| | Claude Code | Antigravity | GitHub Copilot | | Cursor | Kilo Code | Amazon Q | | Aider | OpenCode | Augment | | Cline | Roo Code | Sourcegraph Cody | | Windsurf | Kiro | Tabnine | | OpenAI Codex | Droid (Factory.ai) | |

Using TypeScript type definitions and strict schema validation, the same skill runs on 15+ agents — a standardization layer across harnesses that reduces maintenance cost and improves auditability (audit once, run anywhere). This mirrors OpenResearch's "orx install-skills" approach: don't rebuild agents, build shared infrastructure for existing ones.

Why a secure skill registry matters now

Three converging trends:

1. Explosive agent adoption: Claude Code, Cursor, and Copilot grew from millions of monthly users in 2025 to hundreds of millions in 2026 — the attack surface expanded from developers to all knowledge workers. 2. Growing skill complexity: early skills just read docs and answered; modern skills call APIs, write files, run subprocesses, and access networks — but security infrastructure remains stuck in the "Markdown era." 3. Mature supply chain attack playbooks: proven npm/PyPI/Docker attack techniques (review evasion, time-delay attacks, dependency chain exploitation) transfer directly to the skill ecosystem.

The 13% critical vulnerability rate is not a future risk — it is the current state, and agent-skills is a response to it.

Structural analogy to npm's security evolution

| npm ecosystem | agent-skills | |---|---| | package-lock.json | Lockfile + content hashes | | npm audit | Snyk Agent Scan | | npm publish | CI/CD static analysis + manual review | | package.json scripts | Runtime sandbox + audit logs | | CVE database | Malicious behavior pattern database | | npm install --ignore-scripts | Path isolation + environment variable filtering |

npm took ~10 years to build today's security infrastructure, at great cost once the ecosystem was huge. agent-skills builds it early — trading some convenience to avoid a future event-stream-scale incident.

Bottom line

agent-skills is a security-first skill registry for AI coding agents: 100% open source, six layers of defense, tiered review, and compatibility with 15+ agents. It applies the supply chain security lessons npm took a decade to learn to the skill ecosystem before large-scale attacks arrive.

> Repository: https://github.com/tech-leads-club/agent-skills > Website: https://skillsllm.com > Supports: Claude Code, Cursor, Copilot, Codex, Aider, and 15+ other agents