Monthly Security Report: September 2026

Monthly Security Report: September 2026

Every month we publish what our security evaluation found — the numbers, the notable cases, and what changed in our methodology. This is the first report, covering September 2026.

The numbers

• 611 skills evaluated across 9 categories since launch
• 1 hard veto: a skill with a five-figure GitHub star count, delisted the day its evaluation confirmed credential harvesting
• ~3% of skills had undeclared network destinations — mostly benign API calls missing from the trigger description, but each one was a disclosure gap
• 2 skills flagged for gray-market infrastructure (shared-account mirror domains)
• 1 skill provided geo-restriction circumvention guidance (ToS risk, disclosed in-package)
• 0 confirmed prompt injection attempts in evaluated skills so far

Case study: the credential harvester

The most important find of the month. A topic-research skill — clean README, good documentation, active maintenance, five-figure stars — shipped three scripts:

1. A Safari cookie parser reading ~/Library/Cookies/Cookies.binarycookies
2. A Chromium cookie decryptor using the macOS Keychain
3. A credential extractor pulling auth tokens for specific platforms

None of it was disclosed. The description said "research." Sixty thousand installs said "this is fine."

How it was caught: not by reading the README — by enumerating the skill's capability manifest (every data source, side effect, network destination, and persistence change) and comparing it against what the trigger description promised. The gap between those two sets was the entire signal. It was delisted the same day.

The full story is on our blog.

What the capability manifests found

Since we made capability enumeration a mandatory pre-scoring step this month, patterns across the ecosystem:

• Cloud TTS/video APIs are the most common undeclared destination — skills that generate voiceover or video often call cloud endpoints the description never mentions
• Font scanners that walk ~/Downloads looking for typefaces — benign, but a disclosure gap every time
• Browser-automation skills range from careful (localhost-only listeners, script allowlists) to concerning (whole-profile access with no gating)

Methodology changes this month

• Capability manifests became mandatory (2026-09-17): no security score without a five-category enumeration — data sources, side effects, network destinations, credential access, persistence changes
• Promise-vs-capability gap checks are now a first-class signal feeding the veto decision, not just a workflow deduction
• The full rubric is public at skill123.me/methodology

What to do before installing any skill

1. Grep the scripts for curl, eval, base64, and paths containing Cookies, .ssh, .aws
2. Compare what the skill does with what its description says it does
3. Check where data goes — a script reading credentials locally is a smell; one posting them externally is exfiltration

Or use a directory that does this for you. Every scorecard on Skill123 includes the security scan results and written rationale.

---

Next report: early November 2026. Found something we should look at? Submit a skill for evaluation — we read the scripts.