Why Unvetted AI Agent Skills Are a Silent Security Threat

Overview

The rise of AI agents has introduced a new vector for cyberattacks: unvetted agent skills. Unlike standard software, these text-based instructions are executed directly by autonomous systems that often hold sensitive access to files, terminals, and financial wallets. Researchers auditing public registries in early 2026 discovered hundreds of skills containing malware or credential-stealing payloads, revealing a landscape where trust is easily exploited.

"Markdown is an installer." — Jason Meller, 1Password

This warning underscores the fundamental shift in how users interact with AI tools. A skill is not merely a document; it is an executable order. Because language models process all input as a single sequence of tokens, they cannot reliably distinguish between a user’s direct command and a malicious instruction embedded in a file. Consequently, prompt injection remains the top-ranked risk for LLM applications, according to OWASP.

The Mechanics of the Threat

An agent skill is a text file that provides instructions to an AI agent, which then carries them out using the permissions granted to the software. This creates a unique risk profile because the agent acts on the content with whatever access it holds, including API keys, personal files, and cryptocurrency wallets.

Prompt Injection and Token Ambiguity

Language models lack a reliable mechanism to verify the origin of the instructions they receive. As Simon Willison has noted, every piece of text the model sees is glued into one token sequence. Therefore, a command from a skill file carries the same weight as a command from the human user. This ambiguity allows attackers to craft malicious instructions that blend seamlessly with legitimate task steps.

The threat extends beyond simple text injection. Claude Code allows skills to embed shell commands using dynamic-context syntax. Datadog Security Labs demonstrated that these commands execute before the rendered skill reaches the model. This means defensive measures within the model’s prompt are rendered ineffective. An attacker can include a credential-stealing script that runs immediately upon installation, bypassing any refusal logic intended for the AI.

The "Markdown is an Installer" Reality

Vendors acknowledge the severity of this risk. Anthropic’s documentation explicitly advises users to employ skills only from trusted sources, such as those they have written themselves or received directly from the company. The guidance treats skill installation with the same caution as installing software, noting that skills inherit the network access of the host program.

This perspective is echoed by security experts who argue that the boundary between documentation and code is blurred in this context. A skill folder can also contain scripts or be part of a cloned repository, bringing its own skills without ever touching a marketplace. Organizations are urged to disable shell execution in managed settings to mitigate these immediate risks.

Documented Incidents and Malicious Campaigns

Recent events have moved the threat of unvetted skills from theoretical to empirical. Several high-profile incidents illustrate how attackers are exploiting public registries and user trust.

ClawHavoc and Public Registries

In February 2026, Koi Security audited ClawHub, a public registry for the OpenClaw agent. The audit revealed 341 malicious skills among 2,857 listed, with 335 originating from a single coordinated campaign named ClawHavoc. The primary lure was a "Prerequisites" section that instructed users to install software first, delivering macOS infostealer malware matching the Atomic Stealer family. Within two weeks, as the registry grew to over 10,700 skills, the count of malicious entries rose to 824.

The Most Downloaded and Top-Ranked Risks

Attackers have also manipulated marketplace mechanics to spread malware. 1Password identified the most downloaded skill on ClawHub at the time as a Twitter automation tool that asked for a "required dependency." The installation links led directly to macOS infostealer malware.

Similarly, Cisco discovered a skill that had been pushed to the first rank in a repository. Upon testing, it contained nine security issues, including a silent command to send data to the author’s server and instructions to skip safety rules. These cases highlight that rank and download counts are vulnerable to manipulation and should not be viewed as indicators of safety.

Academic and Industry Scans

Broader scans reinforce the scale of the problem. Snyk analyzed 3,984 skills from ClawHub and skills.sh, finding that 13.4% had at least one critical issue. Human review confirmed 76 malicious payloads, with 91% of them pairing ordinary malware with prompt injection techniques aimed specifically at the agent.

An academic study verified 98,380 skills from two registries, confirming 157 as malicious. More than half were created by a single actor imitating known brands. In another case involving the postmark-mcp npm package, the software operated cleanly for 15 versions before version 1.0.16 added a line to copy every message to an outside address. Additionally, researchers have demonstrated hiding instructions in Cursor and GitHub Copilot rules using zero-width Unicode characters, making malicious text invisible to human reviewers but readable by models.

Lessons from Controlled Tests

To understand the practical effectiveness of these attacks, researchers conducted tests using agents equipped with wallets and various traps. The results showed that obvious attack vectors, such as text demanding authority or hidden base64 characters, largely failed. However, attacks disguised as ordinary task steps succeeded significantly more often.

The Power of Contextual Deception

In the study, a charge dressed as a license fee within a numbered setup guide or an extra item in a shopping list successfully triggered payment attempts. Without active guards, the Sonnet model attempted payment in 10 of 294 trap runs, while Haiku did so in 29 runs.

An attacker never needs to write "ignore your instructions"; a numbered step that says to install a helper first reads exactly like every other line in it.

This underscores the core danger of skills. Since a skill consists entirely of steps that appear to be part of the work, an attacker does not need to force the agent to disobey. They simply need to make the malicious action look like a necessary part of the task. This is precisely how the ClawHavoc "Prerequisites" section operated.

The Importance of Audit and Sandbox Testing

While some studies suggest that marketplace scanners may flag up to 46.8% of skills as malicious, only 0.52% remained suspicious after being read against the associated GitHub project. This indicates that most free skills are harmless, but the difficulty lies in distinguishing the safe ones from the malicious ones based solely on names or descriptions.

Testing revealed that when a model is asked to review a SKILL.md file as text rather than executing it, its ability to detect malicious intent improves. This suggests that manual review and sandboxed execution are critical defenses. Users are advised to read every file in a skill, search for suspicious patterns, and run new skills with tools switched off before granting them full access.