AI agent security scanner: is it safe to install AI agent skills?

A skill is a set of instructions, and sometimes scripts, that your agent follows with your permissions. If your agent can read your email or run commands, so can every skill you give it. That is the whole risk in one line.

What we found

Botlens lists 30,757 public bots, templates and skills. Of those:

11,517 showed no obvious threats in our scan.
1,169 got a Caution badge, mostly for ads or affiliate links, or because only a description was public.
618 were marked Risky and are hidden from the catalog.
18,071 have not been scanned, usually because the source code is not public.

The last line matters most. For more than half of what is out there, nobody outside the author can say what it does.

What a bad skill can do

The patterns our scanner looks for are boring on purpose: reading environment variables where API keys live, uploading data to a remote server, running shell commands, piping a remote script into a shell, and sending messages without asking. None of these is proof of bad intent. A backup skill uploads data; that is its job. But you should know before you install.

A short rule set

Prefer skills whose code you (or a scanner) can read.
Be suspicious of anything that asks for broad permissions for a narrow job.
Approve installs and outgoing messages yourself.
Re-check after updates. A Safe badge is tied to the exact commit we scanned.

Our badges are heuristic. They catch common problems, not every problem. See how to check a skill yourself.

Last checked: 2026-11-01 · How Botlens checks listings: a rule-based scan of public instructions and code, plus a record of how much could be read.

A security scanner for AI agents reads a skill's or template's instructions and code and flags patterns that often mean trouble, such as credential access, hidden uploads, shell commands and sending without asking. It is a useful first filter. It cannot read closed code, so a clean result is a reason to trust more, not a guarantee.

What does an AI agent security scanner check?

It checks for broad classes of risky behaviour in what it can read. Botlens uses a rule-based static scan of the instructions and, where available, the code. It looks for:

reading credentials or key files
uploading data to unexpected servers
running shell commands or piping a remote script into a shell
sending messages without asking
asking for broad permissions for a narrow job
promotional or affiliate links

None of these proves bad intent. A backup tool uploads data because that is its job. The scanner flags it so you can decide.

What should a good scanner show you?

A good scanner shows what it read and which version it read, not just a verdict. Four things make a result useful:

Coverage. Full code, partial, description only, or nothing. Botlens shows this on every bot page.
A pinned version. Botlens records the commit or SHA-256 it read, because a result is only true for that version.
Clear badges. Safe means no obvious threats were found. Caution means something to review. Unscanned means nothing could be read.
Hidden Risky results. Botlens hides Risky listings on the site and in the API, so they cannot be installed by accident from the catalog.

What can an AI agent security scanner miss?

A scanner misses anything it cannot read, and it can miss clever tricks in what it can read. The biggest gap is closed code. Of the 30,757 listings on Botlens, 18,071 are Unscanned because nothing public could be read, compared with 11,517 marked Safe. For Unscanned listings, nobody outside the author can say what they do.

Some listings also get a hands-on behaviour review. Botlens publishes the result per check, in broad areas such as honesty, data access and outbound contacts, without publishing the test material. A review can catch things a static scan cannot, like a template that starts acting before you approve it.

Can a scanner keep agents secure from prompt injection?

Only partly. A scanner can flag a skill whose own instructions tell the agent to follow outside text or skip confirmation. It cannot stop a web page or email from carrying hidden instructions later, while the agent works. That risk depends on how the agent treats what it reads. Our guide to prompt injection in agent skills covers what actually reduces it.

How do I pick a safe Grok Bot template?

Pick one whose instructions you can read, that asks only for the access its job needs, and that drafts instead of sending on its own. A template is a ready-made bot setup, often with skills and routines. A prompt runs once, but a template shapes how a bot behaves every day, including when you are not watching.

Read the instructions like a job description for someone who will hold your keys. Check what it is allowed to do, when it acts, and what it does with outside text. A template that reads web pages or email should treat that text as data. If it tells the bot to follow instructions found in documents, walk away.

Red flags to watch for:

It refuses to show its full instructions, or they are not public.
It tells the bot to hide actions or skip confirmation.
It starts a routine or a first turn on its own right after install.
It pushes a paid tool hard instead of offering it as an option.
It asks for keys in chat.

One red flag is not proof of bad intent, but each is a reason to read closely or pick another template.

Start with no connectors. Ask the bot to explain what it will do and what it needs. Stop if that does not match the listing.
Connect one account. Only the one the main task needs, read-only if you can.
Run a small real task. Read what it did, not only what it says it did.
Start routines paused. Run one by hand before you schedule it.
Keep approvals on. For anything that sends, posts, deletes or pays.
Re-check after updates. A new version is a new template.

Let Botlens pick for you

Yes. Botlens is a free catalog of Grok Bot bots, templates and skills that shows each listing's safety status, and it ships a Grok Bot skill that picks them for you. Describe your task and the skill searches the catalog, skips listings flagged Risky, ranks matches by fit and safety, and asks before installing anything. You don't have to test bots by hand.

Botlens shows each listing's badge: of 30,757 listings, 11,517 are marked Safe and 18,071 are Unscanned. See How to find the right AI bots and skills automatically.

FAQ

Does a Safe badge mean a skill is safe?

No. It means our heuristic scan of a specific commit found no obvious threats. Treat it as a filter, not a guarantee.

Why are Risky bots hidden instead of shown with a warning?

Because people skim. A hidden listing cannot be installed by accident from our catalog.

Is it safe to install AI agent skills? What an AI agent security scanner can tell you