---
type: "Comparison"
title: "Scanned Agent Skills vs Unvetted Skills (2026): Should You Vet Before You Install?"
description: "Scanning AI agent skills before install vs installing unvetted skills (2026): Snyk, Mondoo, NVIDIA SkillSpector data — plus why the CVE feed itself is now contaminated."
resource: "https://www.contextstudios.ai/comparisons/scanned-agent-skills-vs-unvetted-skills"
language: "en"
generated:
  by: "process:contextstudios-md/1"
  at: "2026-10-08T20:59:38.075Z"
status: "stable"
---

# Scanned Agent Skills vs Unvetted Skills (2026): Should You Vet Before You Install?

AI agent skills — the modular, shareable packages of instructions and code that extend what an agent can do — exploded in 2026, with public registries going from under fifty new skills a day to more than five hundred. That convenience came with a supply-chain problem. Security researchers have found malicious payloads, hidden prompt injection, credential theft and overbroad permissions tucked inside skills that look harmless in their description. The question every team now faces is whether to scan and vet each skill before installing it — using tooling like NVIDIA's open-source SkillSpector — or to keep installing skills directly and trust the registry to police itself. This comparison weighs the two approaches across supply-chain risk, setup friction, detection coverage, protection against novel threats, credential safety, ecosystem velocity, operational overhead and compliance, so you can decide how much vetting your agent stack actually needs.

## Detailed Comparison

| Factor | Scanned Agent Skills | Unvetted Agent Skills | Winner |
|--------|------|------|--------|
| Supply-chain risk reduction | Catches malicious payloads, trojans and hidden prompt injection before the skill ever runs in your environment | Inherits whatever the registry missed — known campaigns have planted hundreds of malicious skills that passed casual curation | Scanned Agent Skills |
| Setup speed & friction | Adds a scan step (seconds to minutes per skill) plus a review of flagged findings before install | Install instantly with one command — zero friction, which is exactly why most people skip the checks | Unvetted Agent Skills |
| Malicious-pattern detection coverage | Tooling like SkillSpector checks 64 vulnerability patterns across 16 categories: prompt injection, credential theft, suspicious downloads, overbroad permissions | No systematic detection — relies entirely on a human noticing something off in the SKILL.md or code | Scanned Agent Skills |
| Protection against novel / zero-day skills | Strong on known patterns, but researchers have shown scanners can be bypassed by sufficiently obfuscated payloads | Catches nothing proactively — but a careful manual reviewer can occasionally spot a brand-new trick a scanner has no signature for | Tie |
| Credential & secret-theft prevention | Flags skills that read environment variables, exfiltrate tokens or reach for credentials they don't need | Credential-stealing skills run with your agent's full access on first invocation, before you notice anything | Scanned Agent Skills |
| Access to newest skills & ecosystem velocity | Scanning lags a registry adding 500+ skills a day; the very newest skills may not be scanned or signed yet | Immediate access to anything published the moment it lands, no waiting on vetting pipelines | Unvetted Agent Skills |
| Operational overhead & cost | Requires running a scanner in your install flow or CI, maintaining its rules and triaging findings | No extra tooling, infrastructure or process to maintain — until an incident forces one | Unvetted Agent Skills |
| Compliance & audit trail | Produces a record of what was scanned, what was flagged and what was approved — useful for SOC 2 and client audits | No artifact proving due diligence; in a regulated or client environment that gap is a liability | Scanned Agent Skills |
| Trustworthiness of the vulnerability feed the scanner reads | Only as good as its source — JFrog showed on 30 July 2026 that 54 of 55 CVEs from one GitHub account were AI-fabricated, and NVD plus CISA's ADP had already rated six of them Critical | No feed at all, so no false confidence either — but also no signal, and every genuine advisory is missed alongside the fabricated ones | Scanned Agent Skills |

## Key Statistics

- **Snyk's ToxicSkills study — billed as the first comprehensive security audit of the agent-skills supply chain — found prompt injection in 36% of audited skills and 1,467 malicious payloads across the ecosystem** — [Snyk ToxicSkills study](https://snyk.io/blog/toxicskills-malicious-ai-agent-skills-clawhub) (2026)
- **Mondoo's research found that more than one in four (over 25%) publicly available AI agent skills contain security vulnerabilities** — [Mondoo](https://mondoo.com/blog/agent-skills-real-power-real-risk) (2026)
- **NVIDIA SkillSpector is an open-source (Apache-2.0) security scanner that checks AI agent skills before installation for prompt injection, credential theft, supply-chain risk and malicious code, detecting 64 vulnerability patterns across 16 categories** — [NVIDIA SkillSpector / AI Native Landscape](https://landscape.jimmysong.io/projects/skillspector) (2026)
- **The ClawHavoc campaign planted 341 malicious skills on a public agent-skill registry, distributing the Atomic macOS Stealer and bypassing curation using week-old GitHub accounts** — [Termdock (ClawHub incident postmortem)](https://www.termdock.com/en/blog/clawhub-malicious-skills-incident) (2026)
- **CVE-2025-53773 showed that hidden prompt injection in pull-request descriptions enabled remote code execution via GitHub Copilot, carrying a critical CVSS score of 9.6** — [Cycode](https://cycode.com/blog/ai-security-vulnerabilities) (2026)
- **Trail of Bits researchers bypassed a public registry's malicious-skill detector, warning teams not to outsource trust to a scanner alone — evidence that scanning is necessary but not sufficient** — [Trail of Bits](https://blog.trailofbits.com/2026/06/03/the-sorry-state-of-skill-distribution) (2026)
- **JFrog Security Research reported on 30 July 2026 that 54 of 55 CVEs published from a single GitHub account were entirely AI-fabricated, including six SQLite advisories rated up to 9.8 Critical that referenced functions absent from the reported version and line numbers beyond the file's length.** — [JFrog Security Research — Afek Berger](https://research.jfrog.com/post/sqlite-critical-cves-or-llm-slops/) (2026)
- **The root cause JFrog names is structural: MITRE's CVE submission form has no identity verification, and NIST's manual NVD analysis — the safety net that used to catch this — has been paused since February 2024, leaving enrichment fragmented across CISA and other ADPs.** — [JFrog Security Research — Afek Berger](https://research.jfrog.com/post/sqlite-critical-cves-or-llm-slops/) (2026)

## Choose Scanned Agent Skills when...

- You install skills from public registries where you don't control the authors
- Your agents handle credentials, customer data or anything connected to real money
- You operate in a regulated or client environment that requires an audit trail
- You run multi-agent or autonomous workflows where one bad skill can spread fast

## Choose Unvetted Agent Skills when...

- The skill is one you wrote yourself or comes from a source you fully control
- You're prototyping in a throwaway sandbox with no secrets and no network access to anything sensitive
- You need a brand-new skill the moment it ships and accept the risk consciously
- You have other strong controls (strict sandboxing, no credential access) that contain a bad skill anyway

## Our Recommendation

Scanning agent skills before you install them is the clear baseline — the data is not subtle. With Snyk finding prompt injection in 36% of audited skills and 1,467 malicious payloads across the supply chain, and Mondoo reporting that more than one in four public skills carry vulnerabilities, treating every third-party skill as untrusted code is simply table stakes in 2026. A scanner like NVIDIA's open-source SkillSpector — which checks 64 vulnerability patterns across 16 categories before installation — catches the obvious supply-chain traps that an unvetted install walks straight into. But don't mistake a clean scan for safety: Trail of Bits has already bypassed a public registry's malicious-skill detector, so scanning is necessary, not sufficient. The approach Context Studios takes, and the one we'd recommend, is layered: scan every skill before install, run it under least-privilege sandboxing, review its provenance and requested permissions, and never let an agent install skills autonomously. Skipping the scan only makes sense for skills you wrote yourself or that come from a source you fully control. For anything pulled from a public registry, scan first, sandbox always, and trust nothing by default.

One update since this page was first written, and it cuts at the layer beneath the scanner. On 30 July 2026 JFrog demonstrated that 54 of 55 CVEs published from a single GitHub account were AI-fabricated — six SQLite advisories rated as high as 9.8 Critical referenced functions that did not exist in the targeted version, cited line numbers past the end of the file, and claimed patches that a diff shows never happened. NVD flagged them critical and CISA's ADP concurred. The cause is structural: MITRE's submission form verifies no identity, and NIST's manual NVD analysis has been paused since February 2024. So the argument for scanning still holds, but the claim it supports is narrower than it looks — a scanner is only as trustworthy as the feed it reads, and that feed is now demonstrably contaminated. Scan, sandbox, least-privilege, and verify any finding that would trigger real work against the upstream project's own advisory page.

## Frequently Asked Questions

**Q: Are AI agent skills really a security risk?**
A: Yes. In 2026, Snyk's ToxicSkills audit found prompt injection in 36% of audited agent skills and 1,467 malicious payloads across the supply chain, while Mondoo reported that more than one in four public skills contain security vulnerabilities. Real campaigns like ClawHavoc planted hundreds of malicious skills on public registries distributing credential-stealing malware. Because a skill can carry hidden instructions, overbroad permissions or executable code that does more than its description admits, treating skills as untrusted third-party code is now standard practice.

**Q: What does a tool like NVIDIA SkillSpector actually check?**
A: SkillSpector is an open-source (Apache-2.0) scanner that inspects an agent skill before you install it. It looks for prompt injection, credential theft, suspicious downloads, overbroad permissions and malicious code, covering 64 vulnerability patterns across 16 categories. The point is to answer a simple question — does this skill do more than its description says? — before the skill ever runs with your agent's access.

**Q: If I scan every skill, am I safe?**
A: Scanning makes you much safer, but it is not a guarantee. Trail of Bits researchers have already bypassed a public registry's malicious-skill detector with obfuscated payloads, which is why a clean scan should be treated as necessary, not sufficient. The robust approach is layered: scan before install, then run skills under least-privilege sandboxing, review provenance and requested permissions, and avoid letting agents install skills autonomously.

**Q: When is it acceptable to install an unvetted skill?**
A: Skipping the scan is reasonable for skills you wrote yourself or that come from a source you fully control, or when you're prototyping in a disposable sandbox with no secrets and no sensitive network access. For anything pulled from a public registry — especially when your agent touches credentials, customer data or money — scan first, sandbox always and trust nothing by default.

**Q: If the CVE database itself contains AI-generated junk, is scanning still worth it?**
A: Yes, but calibrate what a clean scan buys you. JFrog's 30 July 2026 analysis found 54 of 55 CVEs from one account fabricated — six SQLite advisories rated as high as 9.8 Critical cited functions that did not exist in the version they targeted, and one cited line numbers past the end of a 2,706-line file. NVD and CISA's ADP had already passed them through. The lesson is not to stop scanning; it is that a scanner inherits the trust level of its feed. Treat severity scores as a prioritisation hint, not a verdict, and confirm anything that would trigger real work against the upstream project's own advisory page.