Why do marketplace security ratings miss malicious AI skills?

Why marketplace ratings miss malicious AI skills

Marketplace ratings are usually designed to judge what can be seen before installation, such as publisher reputation, package metadata, permissions listed up front, or a static review of the submission. Malicious behaviour often appears only after the skill runs, when it receives prompts, chains tools, reaches outside content, or inherits access from the host environment.

That gap matters because a clean-looking listing can still become risky once the skill is connected to sensitive accounts, internal data, or privileged workflows. The rating is often describing the package, not the execution path.

What the rating process actually misses

The first blind spot is dynamic behaviour. A skill can look harmless in the marketplace and still perform unsafe actions only after a user supplies a prompt or the skill retrieves external content during runtime. That means the real decision point is not the listing page, but what the skill can do once it is executing in a live context.

The second blind spot is dependency chaining. A skill may call tools, plugins, APIs, or retrieval sources that are not obvious from the store listing alone. Security ratings that focus on the visible package often miss those downstream connections, even though they are the part that can touch data or trigger side effects. This is why reviews of agentic tool access need to look beyond the package shell and into the Agent Skills Security Guide patterns for allowed tools, skill metadata, and runtime review.

The third blind spot is trust inheritance. A rating system may assume that a marketplace submission is safe because it passed publication checks, yet a deployed skill can still inherit broad workspace permissions, cached tokens, or ambient trust from the platform. That mismatch is especially dangerous when the skill can read, write, or forward data without a user seeing each individual step. For a broader view of how ratings and outside-in assessments can miss these details, see the TPRM and Security Ratings Buyer's Guide.

Why runtime prompt and tool behaviour changes the security picture

Malicious AI skills are often built to stay quiet until they are activated in a realistic session. The harmful part may be a prompt instruction that triggers hidden logic, a tool call that exfiltrates data, or a retrieval step that pulls in content the rating process never exercised. Static analysis alone cannot reliably prove that those paths are safe.

That is why platform security and agent security are not the same as marketplace hygiene. A skill can appear acceptable when reviewed in isolation, but become unsafe once it is attached to identity, data, and action. The practical issue is not just code quality, it is whether the skill can cross from conversation into consequential execution.

For teams evaluating the full control surface, the AI Security Platform Buyer's Guide is useful because it frames runtime guardrails, monitoring, and identity-aware evaluation as separate from the marketplace listing itself. That distinction is what ratings often miss.

Practitioner Guidance

What to verify: Treat the marketplace score as a starting signal, not a deployment approval. Verify the skill's runtime tool inventory, data access paths, and whether the installed version behaves differently from the submitted metadata.

Decision rule: If a skill can reach sensitive data, invoke external actions, or inherit powerful tokens after installation, require a live test of prompt behaviour, tool chaining, and retrieval before allowing production use. If you cannot observe those paths, you do not really know what the rating covered.

What practitioners underestimate: The main failure mode is not that the store is “wrong”, it is that it is measuring the wrong layer. Marketplace review can be useful for baseline screening, but it does not replace runtime inspection of what the skill can actually do once the environment starts trusting it.

Practitioner takeaway: A clean marketplace score should be treated as evidence of low visible risk, not as proof that the deployed skill is safe to execute.

Related resources from NHI Mgmt Group

• How should security teams stop AI agents from installing malicious skills?
• Why do marketplace security scores fail to stop malicious skills?
• Why do traditional security tools miss many AI security risks?
• What do security teams get wrong about AI skills and plugins?