Pattern: Agent Skills Are a 40,000-Listing Unvetted Marketplace and Scanners Miss Malicious Ones

Help Net Security·high signal

One skills marketplace accumulated 40,000+ listings within months of the format's late-2025 debut, almost entirely community-submitted with no vetting — and Help Net Security reports malicious skills routinely slip past the scanners built to catch them. A skill is instructions plus scripts plus files, loaded on demand, which makes it strictly more dangerous than a prompt and strictly harder to statically analyze than a package. Treat third-party skills like unpinned npm dependencies with shell access, because that is what they are.