A validated audit of 3,171 repositories finds 16.0% of agent-harness configurations carry a confirmed security defect

Researchers scanned 3,171 public GitHub repositories: 2,660 assembled agent "setups" and 511 published skill collections. They looked for defects in the instruction files, skills, hooks, and MCP server declarations that make up an agent's harness.

A second, independently written implementation re-derived every flagged finding. A model adjudicated disagreements between the two implementations, then a separate model session checked the results against live platform documentation. This validation reduced the raw detection rate from 25.5% to a confirmed 18.4%.

Among setups, 16.0% carry a confirmed security defect. An unpinned MCP server appears in 9.8%, allowing the agent to run whatever version a public registry serves when it starts. Another 3.1% grant command execution through entries that appear scoped but are functionally unrestricted, such as Bash(python:*). Skills whose front matter pre-approves shell access appear in 3.8% of setups and 3.7% of published skill collections. As the authors put it, "a conventional dependency is reviewed as code, while a skill is a document that instructs a privileged agent to read credentials, run shell commands, or contact the network."

The credential-to-network exfiltration path that motivated the project turned up no confirmed instance across the corpus. That path requires a component with access to secrets to hand work to one with network access. The authors released the scanning tool, corpus manifest, and every validation verdict.

Why it matters: Teams can act on the findings directly. Pin each MCP server declaration to a version or digest. Treat Bash(interpreter:*) grants as unrestricted shell access, and inspect a skill's allowed-tools field before installation. The open-source scanner runs in seconds and can serve as a CI check.