We security-graded 117,854 AI agent skills. Here's what we found.

External security scans of ten Shopify and Shopify Plus agencies revealed that only one scored an A, while three scored C- or below. Nine sites lacked security headers, and six lacked HSTS. Separately, a security grading of 117,854 AI agent skills found that only 17.7% were popular enough for grading. Among those, one in 32 skills is unsafe. Risks persist in the long tail, where installing skills can expose shells and environment variables to untrusted code.