One in Four Skills You Install From the Store Has a Vulnerability

Installing a skill is the most routine move in the agent ecosystem. You spend thirty seconds dropping one into your agent framework — NanoClaw, EvoClaw, AutoAgent, whichever you use — and from then on it executes in every turn of reasoning: reading and writing your files, calling your APIs, touching your data. NVIDIA's SkillSpector scanned 42,447 skills across the stores: 26.1% contain a vulnerability, and 5.2% are malicious. Put another way: install 4 skills and, by probability, one is unclean; install 20 and, by probability, one was placed there by someone with intent.

Don't click away yet. Each of the three things below can be happening on your machine right now, silently.

These numbers come from a store-level sweep, not a vendor's talking point

SkillSpector is NVIDIA's scan of the actual skill inventory — 42,447 skills, not a sample, a full store-level sweep. Read the result in two layers.

26.1% is "flawed." Carelessly written: an unchecked path, an unfiltered parameter, a permission set too wide. 5.2% is "deliberate." The person who wrote that skill placed it there to do something on your machine.

"One in four" and "one in twenty" are arithmetic derived from those ratios — the reciprocal of 26.1% is roughly 3.8, the reciprocal of 5.2% roughly 19.2 — not an independent data source. That's probability, not a guarantee that your machine is compromised this minute. But the day the probability lands, here is what it looks like.

A vulnerability is not an academic problem. It is a permission problem.

A skill with a vulnerability plays out on your machine in three pictures.

Prompt injection hijacks your intent. Hidden in the skill's code is a block of attacker-written text. It isn't obvious, but every time your agent reads it, the model is steered to do something you didn't ask for — call a tool you never authorized, act on rewritten instructions. From where you sit, the agent looks busy. It is not doing your work.

Unprivileged reads of your files. At install, the skill inherits a wide surface: your working directory, config files, environment variables. It doesn't ask each time, because you already said yes. So it reads what it shouldn't — the files holding keys, tokens, internal configuration.

Your conversation leaves the machine. Somewhere in the skill is an outbound request. The question you asked, the context you pasted, the document you asked it to process — encoded into an HTTP call to an address the author chose. You are talking to your agent, and a third party is standing beside you, listening the whole time.

What these three share: none of them errors. The request returns 200, the logs stay clean, the bill looks normal. The most expensive failures don't report themselves — they complete quietly, inside every call you make.

Why you can't see it at install time

Because a skill is written by a person, and the vulnerability lives deep in the call chain. When you review skill code, you are reading what it intends to do. Prompt injection hides inside text that reads like plain language. An over-broad file read hides three function calls down. An exfiltration request hides inside a tool's internal implementation. Most of the 26 vulnerability patterns a manual review will not reliably stop — not because you aren't careful, but because the pattern is designed not to be seen.

Your install decision is one question: do you want this? What the skill does in every turn afterward is not a question you can answer in thirty seconds. The authorization is instant; the exposure is ongoing.

The malicious one: not whether, but which number

A 5.2% malicious rate is not "badly written." It was placed deliberately. That makes it a probability problem, not a quality problem.

Twenty installed skills is normal for a heavy user. At 5.2%, the expected count is one malicious skill — arithmetic, not scare-mongering. The question was never whether you'd step on one. It's which number you installed it at. And before you step on it, there is no signal: malicious skills don't error, they just execute quietly.

Scan three of them now

You don't have to guess. List the skills your agent actually runs, sort by most recently used, paste the code of the top three, and scan.

• The first three are free — the first findings show up immediately, no fine print.
• If the first one hits CRITICAL, do the math on the rest yourself: a full scan is ¥0.7, less than installing another skill.
• The report you get is the baseline you should have had before installing the next one.

Action: open your skill store → sort by most recently used → paste the code of the top three skills → scan.

Scan three skills free → unlock the full report for ¥0.7.

Start here: register a free key at https://correctover.com/rating/register (5 free scans included) → paste the code → scan.