Agent skill registries miss context-specific risks, researchers find

Current security screening systems for agent skill registries focus on a narrow question: is this code malicious? Researchers analyzing ClawHub's public skill library argue this misses a critical dimension of safety—whether a particular action should be allowed in a specific operational context right now.

The Scanner Problem#

Security teams working on OpenClaw's skill registry discovered that existing malware scanners have surprisingly limited overlap. The scanners agree on at most 10.4% of the skills they flag as problematic, and nearly 82% of flagged skills are caught by one scanner in isolation. This fragmentation suggests each tool targets different threat patterns—but it also raises a deeper question: when multiple tools disagree about whether code is safe, the issue may not be which one is correct, but rather what each one was actually designed to detect.

Permitted Actions, Missing Documentation#

The research team examined 66,192 public skill versions and uncovered a critical gap. Some 705 skills across 135 publishers passed every security scanner and received approval from the registry's human reviewers, yet contained actions that security standards like CIS Control 2.7 and NIST SP 800-53 CM-11 explicitly restrict. A hand audit of 100 flagged skills showed the detection system achieved 92% precision with no evidence of deliberate malware—just incompletely documented consequences. One publisher alone contributed 506 of the 705 cases.

In a separate test, agents executed 144 real commands while following published skill documentation. Nearly 35% of those commands involved consequences that the documentation never mentioned. When researchers tested 53 skills with undocumented action types, the proposed enforcement gate blocked all 23 attempts to use them—suggesting even modest context-aware gating could catch overlooked risks.

A Deterministic Alternative#

Rather than relying on machine learning or proprietary heuristics, the researchers propose a rule-based system with no neural component in the decision loop. The design would maintain a trust ledger for each resource type and consequence class, with approval thresholds calibrated to match an operator's stated risk tolerance. Crucially, the authors frame the tradeoff differently: instead of reporting a single false-positive rate, they price the gate's friction across a spectrum of operator policies, recognizing that interruption burden depends on who is making the decision and what they are willing to tolerate.