After the Party: Growth, Governance, and Security Scanning in the OpenClaw Agent Skill Ecosystem
Not on the map. Why?
Abstract (arXiv)
AI agents increasingly act through agent skills, i.e., natural-language instructions, that direct a host agent toward shell, network, credential, file, and process actions, and public registries distribute them at scale. In the first half of 2026, the OpenClaw AI agent went viral, and its public skill registry boomed: the observable stock nearly doubled in 91 days, and a majority of the listings visible in June were created in just two months. By the end of our study window, the wave had crested, and monthly listing creation and core-repository activity were falling from their spring peaks. This paper measures what the boom left behind, drawing on the OpenClaw Git history, its GitHub issues and pull requests, and three ClawHub registry snapshots. Attention is concentrated: the top 10% of skills received 46.93% of all downloads. No simple skill features (like size or download counts) remained a stable predictor of continued listing once creation cohort and skill age were controlled. Human scrutiny did not stay: 77.86% have zero stars and zero comments, while 85.06% of the readable skills carry privilege evidence. And automated cleanup is not ready: the three security scanners disagreed on 23,702 of the 61,990 skills they all cover. After human adjudication, weighted scanner sensitivity against the reference standard ranged from 21.67% to 61.06%. Governing fast-growing agent-skill registries cannot rely on simple metadata or single scanner scores; it requires robust, transparent measurement and independent validation.
Key facts. No citing papers in the map yet (data through 14 Oct 2026). Builds on 22 of its 46 references that are in the map. First posted on arXiv 15 Sep 2026.
Builds on
22 of 46 references.
References · 22
- 2018Model Cards for Model Reportingcited by 1,080
- 2026SkillsBench: Benchmarking How Well Agent Skills Work Across Diverse Taskscited by 315
- 2026Agent Skills in the Wild: An Empirical Study of Security Vulnerabilities at Scalecited by 105
- 2026Agent Skills: A Data-Driven Analysis of Claude Skills for Extending Large Language Model Functionalitycited by 72
- 2026Organizing, Orchestrating, and Benchmarking Agent Skills at Ecosystem Scalecited by 72
- 2026How Well Do Agentic Skills Work in the Wild: Benchmarking LLM Skill Usage in Realistic Settingscited by 65
- 2020Backstabber's Knife Collection: A Review of Open Source Software Supply Chain Attackscited by 61
- 2023LLM Platform Security: Applying a Systematic Evaluation Framework to OpenAI's ChatGPT Pluginscited by 51
- 2023An Empirical Study of Pre-Trained Model Reuse in the Hugging Face Deep Learning Model Registrycited by 47
- 2024Can LLMs Replace Manual Annotation of Software Engineering Artifacts?cited by 42
- 2026Don't Let the Claw Grip Your Hand: A Security Analysis and Defense Framework for OpenClawcited by 29
- 2026Taming OpenClaw: Security Analysis and Mitigation of Autonomous LLM Agent Threatscited by 29
10 more
- 2023Analyzing the Evolution and Maintenance of ML Models on Hugging Facecited by 22
- 2017An Empirical Comparison of Dependency Network Evolution in Seven Software Packaging Ecosystemscited by 20
- 2024Towards Evaluation Guidelines for Empirical Studies involving LLMscited by 15
- 2022A Benchmark Comparison of Python Malware Detection Approachescited by 7
- 2025An Empirical Analysis of Machine Learning Model and Dataset Documentation, Supply Chain, and Licensing Challenges on Hugging Facecited by 6
- 2026ClawHub Security Signals: When VirusTotal, Static Analysis, and SkillSpector Disagreecited by 6
- 2023A Closer Look at the Security Risks in the Rust Ecosystemcited by 5
- 2026A Security Analysis of the OpenClaw AI Agent Frameworkcited by 5
- 2024A Framework for Using LLMs for Repository Mining Studies in Empirical Software Engineeringcited by 4
- 2022Are your dependencies code reviewed?: Measuring code review coverage in dependency updatescited by 2
Built on by
Not cited yet.