Can Agent Skills Handle AI Agent Builder? What to Expect in 2026

Agent Skills Went Mainstream — and Brought a Supply Chain Problem

Agent Skills started as an internal Claude Code convenience and ended 2025 as an open standard. On December 18, Anthropic published Agent Skills for cross-platform portability, and support now spans Claude Code, Codex CLI, Gemini CLI, and AI IDEs like Cursor, per the company's engineering announcement and independent academic research.

The growth curve is staggering. NSFOCUS counts more than 100,000 skills in the ecosystem, and Snyk reports daily submissions jumped from under 50 in mid-January 2026 to over 500 by early February — a 10x increase in weeks. Snyk likens the situation to the early days of npm and PyPI, "except with unprecedented access to credentials, file systems, and APIs."

Security has not kept pace. Three independent studies converge on the same uncomfortable range:

• A large-scale academic study of 31,132 skills found 26.1% contain at least one vulnerability, spanning prompt injection, data exfiltration, privilege escalation, and supply chain risks.
• Snyk's audit of 3,984 skills found 36.82% carry security flaws, with 13.4% containing at least one critical issue.
• NSFOCUS's sampling flagged roughly 21% of reviewed skills with serious risks, most commonly code execution dangers.

This is not a theoretical threat. The ClawHavoc campaign documented by OWASP deployed 1,184 malicious skills across 12 compromised publisher accounts, racking up 247,693 confirmed installations and $2.3M in stolen cryptocurrency. At the campaign's peak, five of the top seven most-downloaded skills were malicious — proof that popularity is not a proxy for safety.

The root cause is architectural. Skills inherit the agent's full permissions: shell access, file system read/write, credentials, and persistent memory. Publishing requires only a SKILL.md file and a week-old GitHub account — no code signing, no security review, no sandbox by default.

The "prompt words plus executable scripts" design makes it worse. Snyk found that 91% of confirmed malicious skills pair prompt injection with malicious code, priming the agent to execute what a human reviewer would reject. Traditional code scanners cannot catch this hybrid threat model, and skills bundling executable code are 2.12x more likely to contain vulnerabilities than instruction-only ones.

Orca Security's conclusion is blunt: "treat every skill as untrusted code, because that's exactly what it is." That is the gap SkillzBench is being built to close — a free, independent directory that verifies, scans, and benchmarks skills before your agent ever loads them.

The Trust Gap: Why Popularity Signals Lie and One-Time Checks Fail

At ClawHavoc's peak, five of the top seven most-downloaded skills were malicious. That single fact should change how you think about every popularity signal in the agent skills ecosystem.

The problem is structural. Orca Security researchers identified four exploitable trust mechanisms in a prominent skills marketplace, including install count inflation through unauthenticated requests — meaning download numbers can be pumped up without any real users. Publishing a skill requires only a SKILL.md file and a week-old GitHub account, with no code signing or security review by default.

Worse, marketplace scans don't keep up with the code. Security scanning runs only at skill creation and again at a popularity threshold, leaving days-to-weeks exploitation windows where a modified skill goes unexamined. A skill that passed its initial scan can turn malicious on any update.

Three failure modes make one-time checks dangerous:

• Silent name collisions: a new skill can override an existing one without warning, so a trusted name you already installed may no longer point to the same code.
• Blind bulk updates: users pulling updates with no version pinning or diff review enabled Orca's delayed-weaponization attack flow, where a previously safe skill shipped malicious changes.
• The consent gap: once you approve a skill, it gains persistent permissions — shell access, file system read/write, credentials — without further prompts, so what it actually does can drift from what you agreed to.

The combined threat model defeats human review too. Snyk found that 91% of confirmed malicious skills pair prompt injection with malicious code — the injected instructions prime the agent to execute code that a reviewer or safety mechanism would normally reject, which is why traditional code scanners miss it. Skills bundling executable code are also 2.12x more likely to contain vulnerabilities than instruction-only skills.

The practical takeaway for agent builders: treat every skill as untrusted code until verified, pin versions to specific commits, and never trust install counts. That's why continuous re-scanning, version pinning to commit SHAs, and sandboxed benchmarking — the pillars SkillzBench is building into its free skills directory — matter more than any single check performed at install time.

What the Industry Is Converging On: Verification as the Baseline

If 2025 was the year agent skills went viral, 2026 is shaping up as the year the industry decides they can't stay unvetted. The signals are already converging: OWASP has released the Agentic Skills Top 10, described as the first comprehensive security framework for AI agent skills, and researchers across academia and industry are calling the same thing in nearly the same words.

The academic study of 31,132 skills put it bluntly: there is "an urgent need for capability-based permission systems and mandatory security vetting." Orca Security, after demonstrating three end-to-end attacks achieving persistent code execution, argued that the rigor applied to package managers and CI/CD pipelines must extend to skill marketplaces — and that until then, every skill should be treated as untrusted code.

Platforms are already moving. After the ClawHavoc campaign — 1,184 malicious skills, 247,693 confirmed installations, and $2.3M in stolen cryptocurrency — ClawHub adopted mandatory security reviews, publisher identity verification, download velocity monitoring, and automated malware scanning. Those mitigations are widely expected to become the industry-wide baseline for 2026.

The practices individual builders should adopt are just as clear:

• Pin versions to specific commits. Orca's delayed-weaponization attack succeeded specifically because users pulled malicious changes through blind bulk updates with no version pinning or diff review.
• Treat install counts as noise. At ClawHavoc's peak, 5 of the top 7 most-downloaded skills were malicious, and counts can be inflated through unauthenticated requests.
• Scrutinize any skill bundling executable scripts — such skills are 2.12x more likely to contain vulnerabilities than instruction-only ones.
• Re-verify continuously. Marketplaces typically scan only at creation and at popularity thresholds, leaving days-to-weeks exploitation windows, so one-time checks aren't enough.

That last point is where independent verification infrastructure matters. SkillzBench is building exactly this model: pinning every skill version to a commit SHA, security-scanning and license-checking each one, benchmarking in a sandbox, and re-scanning as upstream changes land — so a skill's trust score reflects its current state, not its state on the day it went viral.

One more convergence worth noting: skills and MCP aren't rivals. NSFOCUS's analysis concludes that even with MCP in place, skills remain irreplaceable — MCP governs how agents call external tools, while skills deliver instant, expert-level capability with minimal context overhead. Anthropic's own roadmap positions them as complementary, with skills teaching agents complex workflows that use MCP-connected tools.

The direction of travel is unambiguous: verification is becoming the entry fee, not a nice-to-have. Builders who adopt vetting, pinning, and continuous re-scanning now will simply be ahead of where the entire ecosystem is heading.

Your 2026 Playbook: Building with Skills Without Getting Burned

The skills ecosystem doesn't need more paranoia — it needs better habits. With roughly a quarter to a third of published skills carrying vulnerabilities across independent studies, the difference between a productive agent and a compromised one comes down to how you vet, install, and monitor what you load into it.

Here's the playbook the 2026 threat landscape demands.

Treat every skill as untrusted code until verified. That's not hyperbole — it's the explicit conclusion Orca Security reached after demonstrating three end-to-end attacks that achieved persistent code execution. Install counts mean nothing: researchers showed they can be trivially inflated, and at the peak of the ClawHavoc campaign, 5 of the top 7 most-downloaded skills on one marketplace were malicious.

Prefer instruction-only skills, and audit any bundled scripts. A large-scale academic analysis found skills containing executable code are 2.12x more likely to carry vulnerabilities than instruction-only equivalents. When a skill ships scripts, read them before installing — a malicious weather-query skill demonstrated arbitrary command execution once loaded into an agent.

Pin versions to specific commits and never accept blind updates. Orca's delayed-weaponization attack succeeded precisely because users pulled silently poisoned changes through bulk updates with no diff review. Pinning to a commit SHA turns "trust the author forever" into "trust this exact snapshot."

Use detection built for the actual threat model. Traditional code scanners miss the dominant pattern: 91% of confirmed malicious skills pair prompt injection with malicious code, priming the agent to execute what a reviewer would reject. Look for tooling that combines static analysis with semantic classification — the academic SkillScan approach reached 86.7% precision doing exactly that.

Benchmark before you rely, and re-verify continuously. Marketplaces typically scan only at creation and at a popularity threshold, leaving days-to-weeks exploitation windows. A clean check in January proves nothing about February.

• Discover skills from crawled, deduplicated sources rather than raw marketplace listings
• Verify each version with security scanning, license checks, and commit-level pinning
• Benchmark against the same model, with and without the skill, to see real Lift in percentage points
• Equip each agent with only the skills and tools you deliberately chose
• Stay current with change alerts and re-scans whenever upstream content shifts

That list isn't aspirational — it's the exact pillar structure SkillzBench is building: a free directory with discovery, security scanning and trust scores, sandboxed Lift benchmarks, a free MCP connector with per-agent loadouts, and change alerts that re-scan and re-benchmark automatically. Because no research source currently quantifies how much functional Lift skills actually deliver, measuring it under controlled, sandboxed conditions is the missing piece for 2026.

None of this requires heroic effort. It requires treating skills the way mature engineering teams treat npm packages — with provenance, pinning, and periodic re-checks. If you want help putting those habits into practice, join the SkillzBench waitlist to get access as the platform rolls out.