[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-study-finds-most-ai-agent-skills-go-unvetted-after-registry-boom":10,"sections":40},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":30,"tags":31,"sources":35,"feedback":39,"feedback_at":22,"cost_usd":39,"total_tokens":39},6421,"study-finds-most-ai-agent-skills-go-unvetted-after-registry-boom","Study Finds Most AI Agent Skills Go Unvetted After Registry Boom","A study of OpenClaw's ClawHub registry finds most skills draw zero scrutiny and slip past security scanners after the growth spike faded.","A new study of the AI agent OpenClaw's skill ecosystem shows the boom left mostly unchecked code behind.\n\nThe paper, \"After the Party: Governing What a Viral Agent-Skill Ecosystem Left Behind\" (arXiv:2609.17274), traces the first half of 2026, when OpenClaw went viral and its public ClawHub skill registry exploded. The observable stock of skills nearly doubled in 91 days, and most listings visible in June had been created in just the prior two months. Researchers mined the OpenClaw Git history, its GitHub issues and pull requests, and three ClawHub registry snapshots to see what that growth left behind. By the end of the study window, listing creation and core-repository activity were already falling from their spring peaks.\n\nThe numbers are not reassuring. The top 10% of skills account for 46.93% of all downloads, 77.86% of listings have zero stars and zero comments, and 85.06% of readable skills carry evidence of requesting elevated privileges, the kind of shell, network, credential, or file access that matters most if something goes wrong. Once creation cohort and age are controlled for, none of the obvious signals, like size or download counts, reliably predict which skills stick around.\n\nAutomated policing looks even shakier: three security scanners disagreed on 23,702 of the 61,990 skills they all covered, and after human adjudication their sensitivity against a reference standard ranged from just 21.67% to 61.06%. That is the real lesson here: a plugin marketplace can double in three months, but the tooling to vet what is actually in it does not scale nearly as fast.","[\"ai-agents\",\"agent-skills\",\"security\",\"governance\"]","2026-09-16T04:00:00.000Z","2026-09-17T15:33:19.614Z","2026-09-17T15:33:31.542Z","published",null,[24],{"id":25,"reviewer":26,"round":27,"reason":28,"status":29},"editor-r1","editor",1,"Attribute the study specifically (arXiv ID or paper title, e.g. 'After the Party: Governing What a Viral Agent-Skill Ecosystem Left Behind,' arXiv:2609.17274) instead of leaving it as unnamed 'researchers'\u002F'a new study.'","resolved","security",[32,33,30,34],"ai-agents","agent-skills","governance",[36],{"name":37,"url":38},"arXiv cs.AI","https:\u002F\u002Farxiv.org\u002Fabs\u002F2609.17274",0,{"sections":41},[42,47,51,56,61,65,69,74,79,83,88,93,98,103],{"name":43,"slug":44,"count":45,"latest_published_at":46},"AI","ai",3853,"2026-09-17T08:27:09.000Z",{"name":48,"slug":30,"count":49,"latest_published_at":50},"Security",648,"2026-09-17T04:00:00.000Z",{"name":52,"slug":53,"count":54,"latest_published_at":55},"Policy","policy",338,"2026-09-11T04:00:00.000Z",{"name":57,"slug":58,"count":59,"latest_published_at":60},"Deals","deals",179,"2026-06-29T20:02:07.000Z",{"name":62,"slug":63,"count":64,"latest_published_at":50},"Hardware","hardware",154,{"name":66,"slug":67,"count":68,"latest_published_at":50},"Science","science",114,{"name":70,"slug":71,"count":72,"latest_published_at":73},"Consumer Tech","consumer-tech",99,"2026-09-09T17:27:33.000Z",{"name":75,"slug":76,"count":77,"latest_published_at":78},"Software","software",75,"2026-09-10T20:41:21.000Z",{"name":80,"slug":81,"count":82,"latest_published_at":50},"Dev Tools","dev-tools",73,{"name":84,"slug":85,"count":86,"latest_published_at":87},"Startups","startups",55,"2026-09-09T23:14:29.000Z",{"name":89,"slug":90,"count":91,"latest_published_at":92},"Gaming","gaming",43,"2026-09-10T12:18:06.000Z",{"name":94,"slug":95,"count":96,"latest_published_at":97},"General","general",41,"2026-09-08T01:57:23.000Z",{"name":99,"slug":100,"count":101,"latest_published_at":102},"Reviews","reviews",20,"2026-06-24T12:00:01.000Z",{"name":104,"slug":105,"count":106,"latest_published_at":107},"How-To","how-to",6,"2026-06-16T09:00:00.000Z"]