A new measurement study of OpenClaw's skill registry finds that a boom in AI agent add-ons left behind a governance mess: thousands of unreviewed, privilege-hungry skills and security scanners that can't agree on what's dangerous.
OpenClaw is an AI agent that runs on "skills" - plain-language instructions that tell it to touch shells, networks, credentials, files, and processes. Its public skill registry nearly doubled in 91 days during the first half of 2026, with most of June's listings created in the prior two months, according to a paper drawing on OpenClaw's Git history, GitHub issues and pull requests, and three registry snapshots. By the end of the study window, growth was already slowing from its spring peak. The researchers found that 85.06% of readable skills carry evidence of requesting elevated privileges, and 77.86% have zero stars and zero comments - meaning almost nobody is checking what these things actually do before installing them.
The scanner numbers are the real headline. Three security scanners disagreed on 23,702 of the 61,990 skills they all covered, and after humans manually adjudicated the disputes, the scanners' sensitivity ranged from just 21.67% to 61.06%. That's not a rounding error - it means the tools meant to catch malicious or over-privileged skills miss more than they catch, in some cases most of them. Attention is also lopsided: the top 10% of skills pull in 46.93% of all downloads, so popularity does the opposite of what you'd want, concentrating trust rather than distributing scrutiny.
This is the same shape of problem that hit npm and PyPI years ago - a package registry grows faster than anyone can vet it, and automated scanning turns out to be a weak substitute for review. The difference here is the blast radius: a malicious npm package might exfiltrate data, but a malicious OpenClaw skill can be handed shell and credential access outright. Marketplaces for autonomous agents are repeating open-source supply-chain mistakes, just with sharper teeth.
The paper's own conclusion undercuts any scanner vendor's pitch: no single tool caught even two-thirds of the problems reliably. If your agent registry's safety plan is "run a scanner," this data suggests you're covering, at best, six in ten cases.