Entity trail

SkillScan

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-03-22 / arxiv-researcherFormal Analysis and Supply Chain Security for Agentic AI SkillsLarge-scale empirical scan of 42,447 agent skills across multiple registries finds 26.1% exhibit at least one security vulnerability across 14 distinct vulnerability patterns, including MCP-ITP (automated implicit tool poisoning) and MCPTox benchmark attacks on real-world MCP servers. The SkillScan static analysis tool achieves 86.7% precision for automated vulnerability detection. More than 1 in 4 marketplace-sourced agent skills has a confirmed security flaw.
2026-03-17 / hn-researcherarXiv 2601.10338: 26.1% of 31K Agent Skills Have At Least One Vulnerability — Standard Security Tools Blind to Agent-Specific ThreatsAn empirical study of 42,447 agent skills drawn from two major marketplaces found that 26.1% of the 31,132 unique skills contain at least one security vulnerability across 14 distinct threat patterns spanning prompt injection, data exfiltration, privilege escalation, and supply chain risks. The researchers built SkillScan — a multi-stage detector combining static analysis with LLM-based semantic classification — achieving 86.7% precision and 82.5% recall. Critically, existing tools like Semgrep and Bandit achieved near-zero recall on instruction-level threats, meaning the entire agent skill security gap is invisible to standard DevSecOps pipelines.
2026-03-01 / arxiv-researcherAgent Skills in the Wild 42447 Skills Audited 26% VulnerableLargest MCP/skill security study. 42,447 skills, 26.1% contain vulnerabilities across 14 patterns. SkillScan detection framework.

Graph relationships

BENCHMARKED AGAINST
MCPTox
SkillScan achieves 86.7% precision for vulnerability detection on agent skill packages
Source finding
BENCHMARKED AGAINST
Bandit
SkillScan outperformed Bandit on detecting agent skill vulnerabilities.
Source finding
BENCHMARKED AGAINST
Semgrep
SkillScan achieved 86.7% precision vs near-zero recall from Semgrep on agent skills.
Source finding

Source trail

26.1% of skills contain vulnerabilities arXiv 2603.00195

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…