Scanned Agent Skills vs Unvetted Skills (2026): Should You Vet Before You Install?
Scanning AI agent skills before install vs installing unvetted skills (2026): Snyk, Mondoo, NVIDIA SkillSpector data — plus why the CVE feed itself is now contaminated.
Scanning agent skills before you install them is the clear baseline — the data is not subtle. With Snyk finding prompt injection in 36% of audited skills and 1,467 malicious payloads across the supply chain, and Mondoo reporting that more than one in four public skills carry vulnerabilities, treating every third-party skill as untrusted code is simply table stakes in 2026. A scanner like NVIDIA's open-source SkillSpector — which checks 64 vulnerability patterns across 16 categories before installation — catches the obvious supply-chain traps that an unvetted install walks straight into. But don't mistake a clean scan for safety: Trail of Bits has already bypassed a public registry's malicious-skill detector, so scanning is necessary, not sufficient. The approach Context Studios takes, and the one we'd recommend, is layered: scan every skill before install, run it under least-privilege sandboxing, review its provenance and requested permissions, and never let an agent install skills autonomously. Skipping the scan only makes sense for skills you wrote yourself or that come from a source you fully control. For anything pulled from a public registry, scan first, sandbox always, and trust nothing by default. One update since this page was first written, and it cuts at the layer beneath the scanner. On 30 July 2026 JFrog demonstrated that 54 of 55 CVEs published from a single GitHub account were AI-fabricated — six SQLite advisories rated as high as 9.8 Critical referenced functions that did not exist in the targeted version, cited line numbers past the end of the file, and claimed patches that a diff shows never happened. NVD flagged them critical and CISA's ADP concurred. The cause is structural: MITRE's submission form verifies no identity, and NIST's manual NVD analysis has been paused since February 2024. So the argument for scanning still holds, but the claim it supports is narrower than it looks — a scanner is only as trustworthy as the feed it reads, and that feed is now demonstrably contaminated. Scan, sandbox, least-privilege, and verify any finding that would trigger real work against the upstream project's own advisory page.
Detailed Comparison
A side-by-side analysis of key factors to help you make the right choice.
| Factor | Scanned Agent SkillsRecommended | Unvetted Agent Skills | Winner |
|---|---|---|---|
| Supply-chain risk reduction | Catches malicious payloads, trojans and hidden prompt injection before the skill ever runs in your environment | Inherits whatever the registry missed — known campaigns have planted hundreds of malicious skills that passed casual curation | |
| Setup speed & friction | Adds a scan step (seconds to minutes per skill) plus a review of flagged findings before install | Install instantly with one command — zero friction, which is exactly why most people skip the checks | |
| Malicious-pattern detection coverage | Tooling like SkillSpector checks 64 vulnerability patterns across 16 categories: prompt injection, credential theft, suspicious downloads, overbroad permissions | No systematic detection — relies entirely on a human noticing something off in the SKILL.md or code | |
| Protection against novel / zero-day skills | Strong on known patterns, but researchers have shown scanners can be bypassed by sufficiently obfuscated payloads | Catches nothing proactively — but a careful manual reviewer can occasionally spot a brand-new trick a scanner has no signature for | |
| Credential & secret-theft prevention | Flags skills that read environment variables, exfiltrate tokens or reach for credentials they don't need | Credential-stealing skills run with your agent's full access on first invocation, before you notice anything | |
| Access to newest skills & ecosystem velocity | Scanning lags a registry adding 500+ skills a day; the very newest skills may not be scanned or signed yet | Immediate access to anything published the moment it lands, no waiting on vetting pipelines | |
| Operational overhead & cost | Requires running a scanner in your install flow or CI, maintaining its rules and triaging findings | No extra tooling, infrastructure or process to maintain — until an incident forces one | |
| Compliance & audit trail | Produces a record of what was scanned, what was flagged and what was approved — useful for SOC 2 and client audits | No artifact proving due diligence; in a regulated or client environment that gap is a liability | |
| Trustworthiness of the vulnerability feed the scanner reads | Only as good as its source — JFrog showed on 30 July 2026 that 54 of 55 CVEs from one GitHub account were AI-fabricated, and NVD plus CISA's ADP had already rated six of them Critical | No feed at all, so no false confidence either — but also no signal, and every genuine advisory is missed alongside the fabricated ones | |
| Total Score | 5/ 9 | 3/ 9 | 1 ties |
Key Statistics
Real data from verified industry sources to support your decision.
Snyk ToxicSkills study
Mondoo
NVIDIA SkillSpector / AI Native Landscape
Termdock (ClawHub incident postmortem)
Cycode
Trail of Bits
JFrog Security Research — Afek Berger
JFrog Security Research — Afek Berger
All statistics come from verified third-party sources. Source, year, and direct link are shown on each metric.
When to Choose Each Option
Clear guidance based on your specific situation and needs.
Choose Scanned Agent Skills when...
- You install skills from public registries where you don't control the authors
- Your agents handle credentials, customer data or anything connected to real money
- You operate in a regulated or client environment that requires an audit trail
- You run multi-agent or autonomous workflows where one bad skill can spread fast
Choose Unvetted Agent Skills when...
- The skill is one you wrote yourself or comes from a source you fully control
- You're prototyping in a throwaway sandbox with no secrets and no network access to anything sensitive
- You need a brand-new skill the moment it ships and accept the risk consciously
- You have other strong controls (strict sandboxing, no credential access) that contain a bad skill anyway
Our Recommendation
Scanning agent skills before you install them is the clear baseline — the data is not subtle. With Snyk finding prompt injection in 36% of audited skills and 1,467 malicious payloads across the supply chain, and Mondoo reporting that more than one in four public skills carry vulnerabilities, treating every third-party skill as untrusted code is simply table stakes in 2026. A scanner like NVIDIA's open-source SkillSpector — which checks 64 vulnerability patterns across 16 categories before installation — catches the obvious supply-chain traps that an unvetted install walks straight into. But don't mistake a clean scan for safety: Trail of Bits has already bypassed a public registry's malicious-skill detector, so scanning is necessary, not sufficient. The approach Context Studios takes, and the one we'd recommend, is layered: scan every skill before install, run it under least-privilege sandboxing, review its provenance and requested permissions, and never let an agent install skills autonomously. Skipping the scan only makes sense for skills you wrote yourself or that come from a source you fully control. For anything pulled from a public registry, scan first, sandbox always, and trust nothing by default. One update since this page was first written, and it cuts at the layer beneath the scanner. On 30 July 2026 JFrog demonstrated that 54 of 55 CVEs published from a single GitHub account were AI-fabricated — six SQLite advisories rated as high as 9.8 Critical referenced functions that did not exist in the targeted version, cited line numbers past the end of the file, and claimed patches that a diff shows never happened. NVD flagged them critical and CISA's ADP concurred. The cause is structural: MITRE's submission form verifies no identity, and NIST's manual NVD analysis has been paused since February 2024. So the argument for scanning still holds, but the claim it supports is narrower than it looks — a scanner is only as trustworthy as the feed it reads, and that feed is now demonstrably contaminated. Scan, sandbox, least-privilege, and verify any finding that would trigger real work against the upstream project's own advisory page.
Frequently Asked Questions
Common questions about this comparison answered.
Need help deciding?
Book a free 30-minute consultation and we'll help you determine the best approach for your specific project.