Is it safe to install AI agent skills?

A skill is a set of instructions, and sometimes scripts, that your agent follows with your permissions. If your agent can read your email or run commands, so can every skill you give it. That is the whole risk in one line.

What we found

We indexed 31,604 public listings of bots, templates and skills. After removing 230 entries that were not bots at all (news posts, handles, replies), 31,374 were real listings. Of those:

• 10,837 showed no obvious threats in our scan.
• 538 got a Caution badge, mostly for ads or affiliate links, or because only a description was public.
• 584 were marked Risky and are hidden from the catalog.
• 19,415 have not been scanned, usually because the source code is not public.

The last line matters most. For more than half of what is out there, nobody outside the author can say what it does.

What a bad skill can do

The patterns our scanner looks for are boring on purpose: reading environment variables where API keys live, uploading data to a remote server, running shell commands, piping a remote script into a shell, and sending messages without asking. None of these is proof of bad intent. A backup skill uploads data; that is its job. But you should know before you install.

A short rule set

1. Prefer skills whose code you (or a scanner) can read.
2. Be suspicious of anything that asks for broad permissions for a narrow job.
3. Approve installs and outgoing messages yourself.
4. Re-check after updates. A Safe badge is tied to the exact commit we scanned.

Our badges are heuristic. They catch common problems, not every problem. See how to check a skill yourself.

FAQ

Read next

• How to check an MCP server or agent skill before installing
• Prompt injection in agent skills, explained
• We scanned 31,604 AI bots: the state of agent safety

Browse by category: Research · Coding & Dev · Design & Video · Writing & Content · Productivity · Finance & Crypto