Profiling reveals capabilities that threat labels miss in agent skills

When someone installs an agent skill, its instructions and scripts can operate through the session’s existing shell, files, network access and credentials.

How can marketplace reviewers assess that reach before deployment, when a malicious-intent label says whether a skill appears harmful but not what it can access?

The method combines whole-bundle inspection, dependency checks and sandbox traces to profile what a skill may bring into play.

The authors applied the method to 6,309 popularity-banded listings from two marketplaces, selected without threat- or risk-based filtering. Static analysis found elevated capabilities in 4,431, about seven in ten; among listings at high or critical exposure, four in five had benign threat verdicts.

Because capability and intent are separate measurements, a benign verdict does not mean a bundle has little reach; profiling adds that missing view.

The rates describe a popularity-banded sample, not either marketplace as a whole. A single sandbox session exercises only some code paths, and no external ground truth was available to validate the scanner’s labels.