Agent Skills FAQ: Installation, Safety and Compatibility

The Trust Gap: Why 1 in 4 Skills Are Risky

Agent skills have grown faster than the security mechanisms designed to vet them — and the gap is now measurable, not hypothetical. A large-scale academic analysis of 31,132 unique skills found that 26.1% contain at least one vulnerability, spanning 14 distinct patterns across four categories. Independent industry auditing tells the same story: Snyk's review of 3,984 skills reported that 13.4% carry at least one critical-level flaw, while 36.82% show at least one issue of any severity.

The structural reason is simple. Skills run with the full permissions of the host agent — shell, filesystem, credentials, and persistent memory — and there is no sandbox by default. Publishing a malicious skill requires only a Markdown file and a one-week-old GitHub account, with no code signing and no review step. Daily skill submissions jumped from under 50 in mid-January 2026 to over 500 by early February 2026, a tenfold increase in weeks that outpaced any moderation capacity the ecosystem had.

This is not a theoretical risk. The ClawHavoc campaign, documented in January 2026, planted 1,184 malicious skills across 12 publisher accounts, all beaconing to a single command-and-control IP. Five of the top seven most-downloaded skills on ClawHub at peak infection were confirmed malware delivering Atomic Stealer — targeting macOS crypto wallets, SSH keys, and browser credentials. Earlier, in December 2025, researchers demonstrated a "GIF Creator" skill that silently downloaded and executed MedusaLocker ransomware. Three lines of markdown in a SKILL.md were enough to exfiltrate SSH keys.

The threat model is also new. Malicious skills uniquely combine two attack layers — executable code and natural-language prompt injection — with 100% of confirmed malicious skills containing code patterns and 91% simultaneously embedding prompt injection. OWASP warns that a signature proves authorship, not safety, and that signing must compose with behavioral scanning and reputation systems rather than replace them.

The result is a Wild West environment where popularity signals mean little. Some marketplaces accept skills with as low a quality bar as "has two or more GitHub stars," and stars indicate attention, not safety. Anthropic's own documentation acknowledges that skills can introduce vulnerabilities and enable agents to exfiltrate data, recommending users install only from trusted sources and thoroughly audit untrusted skills.

For teams adopting agent skills today, the practical implication is that the install decision is the security decision. Snyk's researchers put it bluntly: "If you've installed one in the past month, there's a 13% chance it contains a critical security flaw and a non-zero chance it's actively exfiltrating your credentials right now."

Want skills you can actually trust? Browse and benchmark free, security-scanned skills on SkillzBench — the independent directory where every version is pinned, every score is earned, and nothing is pay-to-play.

Decoding Compatibility: How Skills Fit Your Agent

Under the hood, every agent skill is deceptively simple: a folder containing a SKILL.md file that holds the instructions, metadata, and — sometimes — executable scripts your agent loads on demand. That same simplicity is what makes skills portable across tools and easy to abuse.

A technical breakdown of the skill architecture explains that each skill bundles a SKILL.md manual, a scripts subdirectory, and reference assets that load progressively as the agent needs them. The format works across Claude Code, Codex CLI, and Gemini CLI, and it layers alongside MCP rather than replacing it — skills handle capability loading, while MCP manages calls to external tools.

Scoping decides where a skill applies and how much damage it can do. Most agents support two levels:

• Project-level skills live inside a single project's config directory and only activate for that project — the safer choice for anything touching sensitive code or credentials.
• Personal-level skills install to your home directory and load for every project you run, multiplying both convenience and blast radius.

Security researchers recommend project-level scoping for sensitive work precisely because personal skills apply everywhere — one compromised instruction file follows you across every repository you touch.

Compatibility also shapes risk. A large-scale study of 31,132 unique skills found that skills bundling executable scripts are 2.12× more likely to contain vulnerabilities than instruction-only skills. If two skills do the same job and one ships only Markdown, that's the one worth trying first.

The reason for that gap is a dual-layer threat model unique to skills. Malicious authors hide payloads in two places at once: the code layer (shell scripts, Python) and the natural-language layer (markdown prose that manipulates your agent's behavior). Snyk's audit of 3,984 skills found 100% of confirmed malicious skills carried malicious code patterns while 91% simultaneously used prompt injection in their instructions.

That combination defeats naive review. Reading the scripts won't reveal instructions that quietly steer the agent toward exfiltration later in the session, and reading the prose won't reveal a shell one-liner buried in a setup script. You have to audit both layers — or rely on someone who does.

This is exactly the gap SkillzBench is building to close: every skill in its free directory gets pinned to a commit SHA, security-scanned across both layers, and benchmarked in a sandbox so you can see measured Lift before you equip it to any agent.

The VBE Framework: Verify, Benchmark, Equip

If roughly one in four skills carries a vulnerability, the question isn't whether to defend yourself — it's how. The good news is that the security community has converged on a layered answer, and it maps cleanly onto three practices we call the VBE framework: Verify, Benchmark, Equip.

Verify: pin it, scan it, trust behavior — not badges

The arXiv study of 31,132 skills found that 26.1% contain at least one vulnerability, and skills bundling executable scripts are 2.12× more likely to be flawed than instruction-only ones. Verification means pinning every skill version to a specific commit SHA — so the file you audited is the file that runs — and running automated security scanning alongside it. As OWASP's Agentic Skills Top 10 puts it, "a signature proves authorship, not safety," so scanning must complement signing, never be replaced by it. This is exactly the verification layer SkillzBench is building: every version pinned to a commit SHA, license-checked, and security-scanned before it enters the directory.

Benchmark: measure whether a skill actually helps

Safety is necessary but not sufficient — a skill can be clean and still useless. Benchmarking closes that gap by running the same task, with the same model, with and without the skill, in a sandboxed environment. Sandboxing does double duty here: it protects you during testing, and it's proven in production. Anthropic's internal testing found sandboxing cut permission prompts by 84%. SkillzBench's benchmarking approach publishes the resulting "Lift" — the performance difference in percentage points — so you see measured impact, not marketing claims.

Equip: least privilege per agent

Even a verified, benchmarked skill can misbehave, so limit the blast radius. The NVIDIA AI Red Team warns that once control passes to a subprocess, the application loses visibility — so scope aggressively. Practical least-privilege steps include:

• Give each agent only the skills and tools it explicitly needs — nothing on by default.
• Prefer project-level skills over personal skills for sensitive work, since personal skills apply everywhere.
• Restrict network egress and block writes outside the workspace.
• Never rely on a single control; layer pinning, scanning, sandboxing, and scoping together.

SkillzBench's per-agent loadouts operationalize this: you toggle skills and tools per agent, and the agent only ever sees what you chose for it.

Why layering matters

No single defense holds. Snyk's audit found 13.4% of skills carry a critical-level issue, and manual approval alone breeds habituation. VBE works because each layer catches what the others miss — verification stops known-bad code, benchmarking exposes silent failure, and least privilege contains whatever slips through.

ctaText: See how SkillzBench verifies, benchmarks, and equips agent skills — join the free waitlist at skillzbench.com. socialProofText: Skills, proven — every skill pinned to a commit SHA, scanned, and benchmarked for Lift. All free, always.

Practical Installation & Safety Checklist

Installing an agent skill shouldn't feel like rolling the dice — yet with roughly a quarter of skills in the wild carrying at least one vulnerability, treating every new SKILL.md as guilty until proven innocent is the only realistic posture.

Start with the file itself. Open the SKILL.md and read it like a contract: scan every shell command, file path, network request, and dependency. Flag anything obfuscated — base64 blobs, hex-encoded strings, or dynamically fetched scripts. A large-scale academic study found that skills bundling executable scripts are 2.12× more likely to contain vulnerabilities than instruction-only skills. If a skill is too dense or clever to parse in a few minutes, that's a signal to walk away.

• Pin every version to a commit SHA — mutable tags and branches can be rewritten after you've already installed.
• Prefer instruction-only skills — pure markdown guidance carries a fraction of the risk of bundled scripts.
• Sandbox the execution environment — restrict network egress, block writes outside the workspace, and isolate the agent from credentials and config files.
• Scope skills per project, not per user — project-level installation limits blast radius if something goes wrong.
• Never auto-execute "prerequisite" copy-paste commands — that's where the ClawHavoc-style payloads hid.

Sandboxing does double duty. Beyond the security win, Anthropic found that sandboxed Claude Code cut permission prompts by 84% — fewer interruptions, tighter defaults. The NVIDIA AI Red Team reinforces the point: once control passes to a subprocess, the application loses visibility, so OS-level isolation is the layer that actually contains damage.

The hard truth is that no single control holds. OWASP warns that signatures prove authorship, not safety — a verified publisher can still ship malicious content. Manual approval alone breeds habituation, where users click "allow" on reflex. Layered defenses (scanning, sandboxing, version pinning, and reputation signals) are the only credible answer.

That's the gap SkillzBench is built to close. Its free directory crawls and deduplicates skills from GitHub, pins every version to a commit SHA, runs security scans and quality checks, and benchmarks each skill in a sandbox so you see the actual Lift before installing. The free MCP connector lets you toggle skills and tools per agent — each agent only sees what you explicitly chose. Join the waitlist at skillzbench.com to get early access.