basitalisandhu

Agent Skills State 2026 — Security skill for Claude Code

Security community

Study of 2,999 public agent skill, plugin and MCP repositories (October 2026): missing security policies, unpinned MCP servers, unrestricted shell in skills, front matter that fails to parse.

How to install Agent Skills State 2026

This entry records only its repository, not the path inside it, so there is no exact command to give. Open basitalisandhu/agent-skills-state-2026 and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Agent Skills State 2026 does

Study of 2,999 public agent skill, plugin and MCP repositories (October 2026): missing security policies, unpinned MCP servers, unrestricted shell in skills, front matter that fails to parse. Dataset (CC BY 4.0), method, hand-checked precision and scripts.

Alternatives in Security

Security Guardian — Comprehensive security analysis for RTK CLI tool, focusing on command injection, shell escaping, hook security 11.9k ★
Curate Security Results — Run Security Tests & Curate Results — Public-Safe Snapshots 295 ★
Public Skills Builder — Generate Claude Code bug bounty skills from public HackerOne reports and GitHub writeups — 18 vuln classes, no 155 ★

README

The state of public agent skills and MCP servers, October 2026

*Muhammad Basit Ali, 13 October 2026. Dataset, method and scripts are in this repository. Data and text: CC BY 4.0. Code: MIT.*

*This is the first edition. The scan is re-run every month and each month's data is added alongside; see [Updated monthly](#updated-monthly).*

Agent skills, plugin marketplaces and MCP servers are now installed the way browser extensions once were: someone finds a repository, copies a line into a config file and the agent gains new instructions, new shell access or a new process that starts with every session. We wanted to know what that supply looks like on the ground, measured rather than guessed. So we took a random sample of 2,999 public GitHub repositories that ship a `SKILL.md`, a plugin or marketplace manifest, or an MCP `server.json`, scanned them with open-source tools, and hand-checked the scanners before trusting them.

Key findings

No way to report a vulnerability: 2,459 of 2,999 (82.0%) repositories have no SECURITY.md. Among the 434 with 100 or more stars it is still 75.6%.
MCP servers that can change under you: 159 of 346 (46.0%) repositories that configure a local MCP server start at least one with no pinned version; 63 of 346 (18.2%) ask for the latest tag outright.
No licence: 982 of 2,999 (32.7%) have no licence file at the root.
The whole shell: 407 of 2,621 (15.5%) repositories with skills give at least one skill unscoped Bash, 10,073 declarations in all.
Skill headers that do not parse: in 330 of 2,621 (12.6%) repositories with skills, at least one SKILL.md has front matter a standard YAML parser rejects; that is 4,761 of 336,285 (1.4%) files.

Every number in this list is checked against [`data/2026-10/stats.json`](data/2026-10/stats.json) in CI by [`scripts/check_numbers.py`](scripts/check_numbers.py).