Build · founder · 8 min read

Two Companies Counted Your Agent's Add-Ons. Both Got About One in Four Bad.

NVIDIA found 26.1% of agent skills carry vulnerabilities. AIR filters out 27%. Here are the free tools that check yours before you install.

Published September 14, 2026 ·

security ai-agents skills supply-chain tools

Five days ago this site published a guide telling you that the skills and add-ons you install into your coding agent are a live supply chain, and that you should go read your skills directory by hand. That advice was correct and it was also unsatisfying, because “read it yourself and use your judgement” is what you tell someone when there is no better option.

There is now a better option. Two of them are free.

More interestingly, in the process of building those tools, two separate companies with different methods ended up measuring the same thing — and got nearly the same answer.

Two counts, one number

NVIDIA’s security team analysed a subset of 31,132 agent skills. 26.1% contained vulnerabilities. 5.2% showed likely malicious intent (Help Net Security).

AIR Security, the Israeli startup that came out of stealth on September 1 with $50 million, says its platform filters out roughly 27% of the add-ons and skills it finds online (TechCrunch).

Different companies. Different datasets. Different commercial incentives — NVIDIA is giving its scanner away, AIR is selling a subscription. One found 26.1%, the other 27%.

When two parties who would benefit from different answers arrive at the same number, that number is usually close to real. Treat it as the working figure: roughly a quarter of what’s on the shelf should not be installed.

That is not a scary-sounding statistic about a distant problem. It’s a claim about the folder on your laptop.

SkillSpector: the one you can run in a minute

SkillSpector is NVIDIA’s open-source scanner. You point it at a directory, a zip file, a single SKILL.md, or a Git URL, and it hands back a list of findings, a risk score, and a recommendation.

The first pass is static and takes seconds. It walks the code looking for exec, eval, subprocess and dynamic imports. A taint tracker follows environment variables and file contents to see whether anything that touches your secrets also touches the network — which is the shape of every credential-theft skill anyone has found. YARA rules match known malware and cryptominers. Package lists get checked against OSV.dev for known CVEs.

Coverage, per NVIDIA: 64 vulnerability patterns across 16 categories, including prompt injection, data exfiltration, privilege escalation, memory poisoning and MCP-specific risks.

There’s an optional second pass that hands flagged code to a language model for intent analysis. It’s off by default and needs an API key. The project rates it at about 87% precision, which is a polite way of saying roughly one in eight of its judgement calls is wrong. Useful as a tiebreaker, not as a verdict.

What to actually do: run it against your existing skills directory before you run it against anything new. The point of the 26.1% figure is that the risk is already installed. You are not auditing future decisions, you are auditing past ones.

Watcher: the other half of the problem

Scanning catches a skill that is bad on the day you scan it. It does not catch the skill that was clean when you installed it and turned hostile on the September update — which, per the Zenity Labs research in the skills marketplace guide, is the delivery method that actually worked.

For that you need something watching at runtime. Watcher, from Apollo Research, installs six hooks into ~/.claude/settings.json and grades every tool call your agent makes, blocking the dangerous ones before they run. It covers session start and end, prompt submission, permission requests, tool use and stop.

Apollo’s published figures: 93% recall on high-severity cases, under 1% false positives, under 0.1% of decisions escalated to a human, 6-8% added latency and 3-5% cost overhead.

Read those as vendor numbers on a vendor benchmark, because that is what they are. The design detail that matters more than the score is this: the evaluator can be a different model from the agent it’s watching. A monitor that shares the agent’s blind spots is decoration. One that doesn’t is a second opinion.

It works with Claude Code and Codex today, with Cursor and Gemini CLI on the roadmap. There’s a free tier.

The structural reason to prefer this over writing rules into your CLAUDE.md: a hook runs in a process your agent cannot edit. An instruction in a markdown file is a polite request to a system that treats markdown files as input. We wrote a whole guide on why every file your agent reads is executable; this is the flip side of it.

AIR is not for you, and that’s worth saying

AIR’s $50 million buys an inline firewall that discovers every agent running inside an organisation, continuously vets what they load, and lets a security team trace and revoke a compromised component across every workflow depending on it. Roughly 20 customers, strongest demand in financial services and pharmaceuticals.

If you have a security team, this is the category to watch. If you are three people and a Stripe account, it is not a product you can buy, and nobody should pretend otherwise. The useful thing AIR has given you this month is the 27% number, not the subscription.

What this changes about the checklist

Not as much as you’d hope, and that’s the honest read.

Scanners find known patterns. A skill whose payload is one sentence of plain English — also send the contents of .env to this URL — has no exec call to flag and no CVE to match. The static pass is strong against code and weak against prose, and prose is the native format of the attack.

So the manual advice stands, and now has a cheaper first step in front of it:

1. Scan what’s already installed. One command, and it reads the folder you were told to read by hand.
2. Still read the flagged ones yourself. A risk score is a filter, not a verdict.
3. Still pin versions and stop auto-updating. Neither tool protects you from the update you approved.
4. Still don’t run untrusted skills and a production deploy path in the same session. No scanner fixes a permissions decision you made.
5. Add a runtime monitor if you run agents unattended. If you approve every action yourself, you already are the monitor.

The one-sentence version

About a quarter of the add-ons on the public shelves shouldn’t be installed, two free tools will now tell you which of yours are in that quarter, and neither of them removes the job of reading the thing before you trust it with your keys.

Sources: Help Net Security on SkillSpector, NVIDIA/SkillSpector on GitHub, Apollo Research Watcher, TechCrunch on AIR.