Walker maps 6,898 AI agent security skills into 13 domains

Walker published the "AI Agent Security Skills Chaos Map, October 2026 Edition" on its Japanese-language skill search site cccskills on October 27, 2026, according to gamebusiness.jp. The map organizes 6,898 security-related skills from 947 repositories by 814 authors into 13 domains, drawn from the 97,647 public skills listed on cccskills.

Skills are instruction files (SKILL.md) that AI agents such as Claude Code and Codex read, and they run commands and rewrite files with the same permissions as the agent. The map's domains include vulnerability assessment and pentesting, code auditing, threat modeling, malware analysis, and cloud and supply chain.

In the web version, clicking a tile shows that repository's skill list and a safety evaluation judged from the descriptions in SKILL.md. Walker notes that the evaluation is judged from those descriptions and is not the result of auditing the code itself.

Guardrails and official skills get their own domains

Skills that scan other skills or agent behavior before installation, such as NVIDIA's SkillSpector and Cisco's skill-scanner, are placed in a separate domain. Skills published by OpenAI, Anthropic, Google and others are distinguished as "official".

The map also adds a "PHP, WordPress, Laravel" domain in response to the PHP vulnerability announced on October 21, known as php2shell. In January 2026, a large number of malicious skills were distributed on public registries, and OWASP recorded that 1,184 skills were distributed from 12 publisher accounts.