Blog
About 1 in 20 AI Agent Skills Show Signs of Malicious Intent: How Small Businesses Can Check a Skill Before Installing It
Researchers found 5.2% of 31,000+ AI agent skills had high-severity signs of malicious intent. Here's what NVIDIA's free SkillSpector scanner does, and a checklist to use before you install any Claude skill.
Hat tip: this post started with a reel from Jordan Blake (@ai_vanta_ai). Watch it here. We went back to the primary sources so you get the exact numbers and links.
If your business uses Claude, Codex, or another AI agent, you've probably seen "skills": add-ons that teach the AI a new job, like writing proposals in your format, cleaning up spreadsheets, or posting to your CRM. They save a lot of time. They also carry a risk most small-business owners haven't thought about yet.
What is an AI agent skill?
A skill is usually a folder with a text file called SKILL.md in it. That file holds instructions, and the folder may also include scripts, templates, or images. When the AI decides the skill fits the task, it reads those instructions and follows them.
Anthropic, the company behind Claude, puts it this way: skills give Claude new capabilities "through instructions and code, which also means a malicious Skill can direct Claude to call tools or run code in ways that don't match the Skill's stated purpose." (Anthropic docs)
Here's why that matters: a skill runs with whatever access your AI agent already has. In tools like Claude Code, Anthropic notes, skills "have the same network access as any other program on the user's computer." So if your agent can read your project folders, your .env file with API keys, or your client documents, an installed skill can tell it to do the same.
The risk in plain English
Hidden instructions. Text can be hidden in HTML comments, zero-width characters, or encoded strings. You see a clean file, and the AI reads a second set of instructions you never saw.
API keys and logins. A skill can tell the agent to read your keys and send them somewhere, or to paste them into a response.
Client data. Client folders, bills, emails: anything the agent can open, a bad skill can ask it to send out.
Bundled scripts. Code shipped with a skill can run with full access to your environment.
Supply-chain drift. Even a skill that's fine today can change, or pull in a dependency or web page that changes later.
What the research actually found
The "1 in 20" number traces to an academic study, "Agent Skills in the Wild: An Empirical Study of Security Vulnerabilities at Scale" (arXiv 2601.10338). The researchers collected 42,447 skills from two major skill marketplaces and analyzed 31,132 of them. They found:
26.1% had at least one vulnerability.
5.2% (about 1 in 20) showed high-severity patterns strongly suggesting malicious intent.
8.1% were medium severity and 12.8% were low severity only, which the authors describe as mostly sloppy practices like unpinned dependencies, not malware.
The most common issues were data exfiltration (13.3%) and privilege escalation (11.8%).
Skills that bundle executable scripts were 2.12x more likely to contain vulnerabilities than instruction-only skills.
To be accurate: the study covers skills across agent ecosystems, not only Claude, and "strongly suggesting malicious intent" is not the same as confirmed malware. It's still a strong reason to check before you install.
What NVIDIA built: SkillSpector
NVIDIA released SkillSpector, a free, open-source (Apache-2.0) security scanner for AI agent skills. Its README cites the study's numbers above and frames the tool around one question: "Is this skill safe to install?"
Per NVIDIA's README and docs:
What it scans: Git repos, URLs, zip files, folders, or a single SKILL.md.
What it checks: 71 vulnerability patterns across 17 categories (NVIDIA's docs page lists 68, so the count changes by version). Categories include prompt injection, data exfiltration, privilege escalation, supply chain, excessive agency, memory poisoning, tool misuse, rogue-agent behavior, trigger abuse, dangerous code, YARA signatures, and MCP tool poisoning.
Hidden text: it flags hidden instructions in comments and invisible text, zero-width characters, base64, and Unicode tricks like look-alike letters.
Two stages: fast static checks, plus optional AI "semantic" analysis that compares what a skill claims to do with what it actually does.
Known-bad dependencies: it looks up declared packages on OSV.dev.
A risk score from 0 to 100. Higher means riskier, and 51 or above means "DO NOT INSTALL."
Automation: JSON and SARIF output for CI pipelines, plus an MCP server mode so an agent can check a skill before installing it.
It's part of NVIDIA's Verified Skills pipeline, which scans, evaluates, and signs skills before they're published to NVIDIA's skills catalog.
Two caveats from NVIDIA itself: SkillSpector "is defense-in-depth, not a sandbox." It never runs the skill, and it won't protect you from a skill you choose to install anyway. Also, the AI analysis sends file contents to whichever AI provider you configure. Use --no-llm to keep everything local.
Quick start (for whoever handles your tech):
uv tool install git+<SkillSpector GitHub repo URL, linked above>
skillspector scan ./some-skill/ --no-llm
The small-business skill safety checklist
This list is based on Anthropic's enterprise review checklist and NVIDIA's guidance. Go through it before you install any skill.
Know the source. Anthropic's advice: use skills you wrote yourself or got from Anthropic. Be very careful with anything else.
Read every file, not only SKILL.md. Check scripts, linked markdown files, and images too.
Look for scripts (.py, .sh, .js). Anthropic rates them high-concern because they run with full environment access.
Search for network calls: http, curl, fetch, requests. Why does a "format my bill" skill need the internet?
Watch for "file read + send" combos. Reading files and sending data out together is the classic exfiltration pattern.
Check for instructions to hide things. Phrases like "don't tell the user," "ignore previous rules," or behavior that only triggers on certain inputs are red flags.
Make sure there are no hardcoded keys or logins. Secrets belong in environment variables or a login manager, never in a skill.
Check every URL and make sure it points to the domain you expect.
Run a scanner like SkillSpector and don't install anything scored HIGH or CRITICAL.
Test in a sandbox first: a separate folder, user account, or VM that holds no client data and no real keys.
Limit what your agent can reach. Keep client folders and .env files out of the agent's working area, and give API keys the smallest scope possible.
Re-check after updates. A safe skill can change, so scan again when it updates.
On a Claude Enterprise plan? Admins can turn on Skill and plugin security scanning under Organization settings > Skills.
The bottom line
Skills are one of the most useful things to happen to small-business AI, and most of them aren't malicious. But "about 1 in 20 with high-severity red flags" is too high to install skills on autopilot. Treat a skill like software: check where it came from, read it, scan it, and limit what it can reach.
Need help setting up AI safely?
Local Business Search helps small businesses get real value from AI without putting client data or API keys at risk:
Safe AI setup: Claude, agents, and skills configured with sensible permissions.
AI consulting: which tools to use, which to skip, and how to fit them into your workflow.
Small-business IT: secure machines, backups, login management, and access control.
Coming soon: done-for-you how-to videos that walk you through these steps on screen.
👉 Contact Local Business Search to set up AI the safe way.
Sources: NVIDIA SkillSpector (GitHub) · NVIDIA docs · Agent Skills in the Wild (arXiv) · Anthropic Agent Skills security · Anthropic Skills for enterprise · OWASP Agentic Skills Top 10 · Reel by @ai_vanta_ai