A new study analyzed 6,309 agent skills from two marketplaces, revealing that a significant portion grants extensive capabilities to AI agents. The research found that 70% of these skills possess at least one elevated capability, with 50% capable of shell execution and 13% having access to credentials. Furthermore, 59% of skills that declare permissions understate their actual abilities, indicating a gap between declared and actual functionalities. The study proposes a two-phase profiling methodology combining static analysis and sandbox execution to better understand these capabilities, suggesting that current permission models offer limited assurance. AI
IMPACT Highlights potential security risks in AI agent skill installations, prompting a need for better permission models and runtime monitoring.
RANK_REASON Academic paper detailing a new methodology and findings on AI agent skill security. [lever_c_demoted from research: ic=1 ai=1.0]
Read on Hugging Face Daily Papers →
AI-generated summary · Google Gemini · from 1 sources. How we write summaries →
