Agent Skills Directory / Reports
Reports
These are outside reports about the agent skill and plugin ecosystem that we found useful. They are not part of the index data: the directory only contains entries pulled from the official catalogs (see Methodology), and nothing below changes those entries.
We list reports for free: no link swaps, no payment, no sponsored entries. Before listing, we check that a report documents how it was made (sample, data source, date, checks) and we copy its numbers as published. Listing is not an endorsement of the publisher. Know a report that fits? Send it to bugs-skills@branolabs.com.
8 reports: Plugin catalogs and marketplaces · Agent skills: security studies · MCP servers and registries
Plugin catalogs and marketplaces
State of Codex Plugins 2026
- Publisher
- PickAPlugin
- Date
- Data pulled 2026-10-27
- Licence
- CC BY 4.0
- Sample / scope
- 339 reachable GitHub repos of the 346 plugins in the PickAPlugin catalog (open-source ChatGPT and Codex plugins); 274 plugin.json manifests checked
Key findings. Almost all repos (97%) were created in 2026; the median repo has 6 stars and the top 10% hold 94% of all stars. 79% use MIT and 8% have a missing or unidentified licence, 31% have no copyable install command in the README, 43% of READMEs mention an API key or token and 18% configure a remote MCP server over HTTP; of 274 plugin.json manifests only 3 had a hard error.
How it was made. One GitHub GraphQL pull on 2026-10-27 (stars, last push, creation date, licence detection, language, README and root-level manifest files). Install commands are matched by regex on README code blocks, manifests are checked with a port of PickAPlugin's public plugin.json validator, and API-key and remote-MCP flags are keyword matches. Stated limits: a catalog sample, not a census; only root-level files are read, so plugins in subfolders can be missed; API-key and network figures are keyword heuristics.
Figures: PickAPlugin, CC BY 4.0. Read it at pickaplugin.com/research/state-of-codex-plugins-2026. Checked by us 2026-11-03.
On the Maintenance and Co-evolution of Agent Plugins: An Empirical Study of Claude Code Plugin Marketplaces
- Publisher
- Hereiz, Lyu, Li, Adams, Hassan (Queen's University, SAIL lab)arXiv preprint (cs.SE), under review
- Date
- Data Oct 2025 to end of Mar 2026; arXiv 2026-08-28
- Licence
- CC BY 4.0
- Sample / scope
- 1,926 GitHub repos (10+ stars) hosting 2,018 Claude Code plugin marketplaces: 8,351 plugins and 77,773 commits
Key findings. Plugin-touching commits grew 8.8x between the October 2025 launch and March 2026, and 61.3% of plugins target software-engineering tasks. Feature commits are more than twice as common as in conventional open-source projects (39.6% vs 17.2%), Claude is credited as co-author on 34.9% of commits, and inside skills folders the SKILL.md text and its scripts often change together (78% of those co-changes are functionally coupled).
How it was made. Marketplaces found with GitHub Code Search for .claude-plugin/marketplace.json, filtered to repos with at least 10 stars, then plugin manifests and full commit histories extracted; plugins and commits classified with LLM prompts published in the appendix, trends tested with Mann-Kendall. Stated limits: only publicly indexed GitHub files (private or deleted repos missed); the 10-star cut-off drops most repos (81.7% of 10,646 found had fewer than 10 stars), though findings were re-run at 5 and 25 stars; LLM classification can misjudge.
Figures: Hereiz et al., arXiv:2608.28497, CC BY 4.0. Read it at arxiv.org/abs/2608.28497. Checked by us 2026-11-03.
Agent skills: security studies
Context Matters: Repository-Aware Security Analysis of the Agent Skill Ecosystem
- Publisher
- Holzbauer, Schmidt, Gegenhuber, Schrittwieser, Ullrich (IT:U Linz, University of Vienna)AgentSkills '26 Workshop, ACM CAIS 2026 (Best Paper Award)
- Date
- Marketplace data around March 2026; arXiv 2026-03-17 (v2 2026-06-01)
- Licence
- arXiv non-exclusive distribution licence (not an open licence: link only, summary in our own words)
- Sample / scope
- 238,180 unique skills from ClawHub, Skills.sh, SkillsDirectory and skills referenced on GitHub
Key findings. The marketplaces' own scanners flag large shares of skills as malicious (46.8% on ClawHub, 23% on Skills.sh, 6% on SkillsDirectory), but when flagged skills are checked against their surrounding GitHub repository, only 15 of 2,887 flagged skill/repository pairs (0.52%) stay suspicious. Scanners also disagree a lot: only 0.12% of commonly analysed skills were flagged by all five tested scanners. The authors further document a new attack path: skills hosted in seven abandoned GitHub repositories could be hijacked, affecting 121 skills.
How it was made. Crawled the three marketplaces plus GitHub references, downloaded skill folders, ran marketplace scanner results and the Cisco Skill Scanner, then an LLM-based repository-context check comparing each flagged skill with its repo's documentation and code. Stated limits: the repository-aware check is not a definitive ground truth, and attackers could craft repositories that look benign; manual validation covers only a small sample; unavailable repositories, failed clones and changing marketplace references limit reproducibility.
Source: Holzbauer et al., arXiv:2603.16572 (summary in our own words). Read it at arxiv.org/abs/2603.16572. Checked by us 2026-11-03.
“Do Not Mention This to the User”: Detecting and Understanding Malicious Agent Skills in the Wild
- Publisher
- Liu, Chen, Zhang, Deng, Li, Ning, Zhang (Griffith University, NTU, UNSW and others)USENIX Security 2026 (accepted)
- Date
- Data crawled January 2026; arXiv 2026-02-06 (v4 2026-06-10)
- Licence
- CC BY 4.0
- Sample / scope
- 98,380 skills from skills.rest (25,187) and skillsmp.com (73,193); 4,287 candidates; 157 confirmed malicious
Key findings. Static rules plus sandboxed behaviour checks confirmed 157 malicious skills with 632 vulnerabilities across 13 attack techniques, on average 4.03 per skill. Two strategies dominate (credential theft via remote code execution, and agent manipulation through instructions hidden in documentation), over half of the confirmed cases trace to a single actor using templated brand impersonation, and registries removed all 157 after disclosure.
How it was made. Registry crawl in January 2026, static pattern matching to build a candidate set, then dynamic verification of candidates in a Docker sandbox and manual labelling. Stated limits: a January 2026 snapshot; the 60-second dynamic window can miss delayed or environment-gated payloads and sandbox-aware malware; covers two public registries only, not private repositories, enterprise deployments or official curated collections.
Figures: Liu et al., arXiv:2602.06547, CC BY 4.0. Read it at arxiv.org/abs/2602.06547. Checked by us 2026-11-03.
Agent Skills in the Wild: An Empirical Study of Security Vulnerabilities at Scale
- Publisher
- Liu, Wang, Feng, Zhang, Xu, Deng, Li, Zhang (Tianjin University, Southern Cross University, NTU, UNSW, Griffith University and others)arXiv preprint (cs.CR)
- Date
- Data collected December 2025; arXiv 2026-01-15
- Licence
- CC BY 4.0
- Sample / scope
- 42,447 skills collected from skills.rest and skillsmp.com, 31,132 unique skills analysed
Key findings. 26.1% of skills show at least one vulnerability pattern (14 patterns in four groups); data exfiltration (13.3%) and privilege escalation (11.8%) are the most common, and 5.2% show high-severity patterns suggesting malicious intent. Skills that bundle executable scripts are 2.12x more likely to be flagged than instruction-only skills.
How it was made. SkillScan, a multi-stage pipeline combining static analysis with LLM-based classification, calibrated on 500 hand-labelled skills (86.7% precision, 82.5% recall). Stated limits: the 26.1% mixes malice, negligence and ambiguous patterns and should be read as “patterns warranting review”, not confirmed malware; mostly static analysis (dynamic check on only 25 skills); a December 2025 snapshot of a very young ecosystem.
Figures: Liu et al., arXiv:2601.10338, CC BY 4.0. Read it at arxiv.org/abs/2601.10338. Checked by us 2026-11-03.
Technical Report: Exploring the Emerging Threats of the Agent Skill Ecosystem (ToxicSkills)
- Publisher
- Snyk (Beurer-Kellner, Kudrinskii, Milanta, Nielsen, Sarkar, Tal)Technical report, dated 2026-02-05; on arXiv 2026-05-27
- Date
- ClawHub data as of 2026-02-03; report 2026-02-05
- Licence
- CC BY 4.0 (arXiv version)
- Sample / scope
- 3,984 skills ever hosted on ClawHub, plus the 100 most-used skills on skills.sh as a comparison set
Key findings. 13.4% of the 3,984 ClawHub skills (534) had at least one critical issue and 36.82% (1,467) had an issue of any severity; human review confirmed 76 malicious payloads (credential theft, backdoors, data exfiltration), 8 of them still live at publication. In the skills.sh top 100, the prompt-injection and malicious-code detectors found nothing.
How it was made. Automated scans with Snyk's MCP-scan engine (custom LLM judges plus deterministic rules across eight security policies) over a historical ClawHub dump, deduplicated by author and skill ID, then human-in-the-loop confirmation of flagged skills. Stated limits: not every flagged skill was reviewed by hand, so 76 is not the total; republished copies under new IDs count separately; the count was already outdated at publication. Published by a security vendor that sells scanning tools.
Figures: Snyk, arXiv:2605.28588, CC BY 4.0. Read it at arxiv.org/abs/2605.28588. Checked by us 2026-11-03.
MCP servers and registries
A Measurement Study of Model Context Protocol Ecosystem
- Publisher
- Guo, Hao, Zhang, Xu, Lv, Chen, Cheng (Shandong University and others)arXiv preprint
- Date
- Data collected 2025 (14-day crawl); arXiv 2025-09-29 (v3 2025-11-15)
- Licence
- arXiv non-exclusive distribution licence (not an open licence: link only, summary in our own words)
- Sample / scope
- 17,630 raw entries from six MCP marketplaces, 8,401 valid projects analysed (8,060 servers, 341 clients)
Key findings. More than half of listed MCP projects were placeholders, forks, abandoned or otherwise invalid; on MCP.so only 43.4% of server records passed validation. 41.9% of projects appear in several markets but only 6.9% in four or more, so no market is complete; server dependencies show monocultures, and as of August 2025 only 95 of 341 clients supported the officially recommended streamable HTTP transport.
How it was made. MCPCrawler: per-registry adapters, schema normalisation, content hashing for cross-market deduplication and time-versioned snapshots across six markets over a 14-day campaign, then analysis of repository metadata and declared dependencies. Stated limits: a two-week snapshot of a fast-moving ecosystem; based mainly on repository metadata and declared dependencies, so runtime behaviour is not captured.
Source: Guo et al., arXiv:2509.25292 (summary in our own words). Read it at arxiv.org/abs/2509.25292. Checked by us 2026-11-03.
Model Context Protocol (MCP) at First Glance: Studying the Security and Maintainability of MCP Servers
- Publisher
- Hasan, Li, Fallahzadeh, Rajbahadur, Adams, Hassan (Queen's University)arXiv preprint (cs.SE)
- Date
- Dataset as of 2025-06-01; arXiv 2025-06-16 (v5 2026-04-13)
- Licence
- CC BY-NC-SA 4.0
- Sample / scope
- 1,899 open-source MCP servers: 343 from the official MCP collection and 1,556 mined from GitHub (mining cut-off 2025-03-20)
Key findings. SonarQube found vulnerabilities in 7.2% of servers (eight patterns, credential exposure most common at 3.6%), and a dynamic MCP-specific scan found potential tool poisoning in 5.5% of the servers it could run on. 66% of servers had code smells and 14.4% had bug patterns also seen in traditional open-source software.
How it was made. GitHub mining for MCP SDK imports plus the official list, toy-repo filtering and health metrics, static analysis with SonarQube on all servers, dynamic analysis with mcp-scan on a random sample (83 drawn, 73 scanned successfully), and an LLM jury to cluster issues; replication package on GitHub. Stated limits: open-source servers only, so not the whole population; SonarQube's list is not exhaustive; mcp-scan was early-stage and ran on a limited sample.
Figures: Hasan et al., arXiv:2506.13538, CC BY-NC-SA 4.0. Read it at arxiv.org/abs/2506.13538. Checked by us 2026-11-03.