Can Agent Skills Handle AI Coding Tools? What to Expect in 2026

Skills Went Mainstream: The 2026 State of Play

Somewhere between late 2025 and mid-2026, agent skills stopped being a Claude Code curiosity and became plumbing for the entire coding-agent ecosystem. What began at Anthropic as reusable SKILL.md instruction packages now works across Claude Code, Codex, Cursor, Gemini CLI, Kiro, and other agents — and security reporting notes skill repositories grew by at least a third in just six months.

The scale is striking. The Superpowers skill has racked up roughly 226,000 GitHub stars — more than the Vue repository itself — while Karpathy's guidelines repo sits at 174,000 and GStack approaches 110,000, according to community tracking of the most popular skills. For readers, that means a crowded, fast-moving ecosystem where popularity is easy to measure and quality is not.

Three shifts define the 2026 landscape:

• Portability is becoming the norm. Codex now loads Claude plugin marketplaces directly, as the Trail of Bits skills marketplace demonstrates — though per-platform friction persists for surfaces like ChatGPT.
• Skills ship with packages. TanStack Intent bundles SKILL.md inside npm packages, and Vercel's skills CLI installs skills across 70+ agents — so agent guidance updates with the library instead of going stale after a model's training cutoff.
• Cloud vendors arrived. AWS's Agent Toolkit pairs plugins for Claude Code and Codex with curated skills, letting agents load service-specific guidance rather than guessing at half-remembered APIs.

Behind the tooling sits a deeper change in how people code. Andrej Karpathy described flipping from roughly 80% manual coding to 80% agent-directed coding in a single month, and 2026 benchmarks like VISTA show that swapping the harness around a model can move results as much as swapping the model itself. As agent analysts put it, the harness — agents, skills, tools, hooks, MCP — is now the product.

That explosion creates a real problem for anyone adopting skills: nobody has time to vet hundreds of packages that change weekly. SkillzBench is being built for exactly this — a free directory and MCP connector that crawls, dedupes, and security-scans skills so teams can equip agents with verified ones rather than whatever has the most stars. In an ecosystem growing this fast, curation is no longer optional.

The Trust Gap: Why Popular Skills Can Still Be Dangerous

A skill with 300,000 installs sounds like a success story — until you learn every one of those installs was trojanized. That's exactly what happened in the July 2026 "Paperclip" typosquatting incident, where malicious skills racked up massive install counts while comparable trojanized Python packages were caught within hours. The skill ecosystem simply doesn't have the immune system npm has spent two decades building.

The scale of the exposure is sobering. Skill repositories grew by at least a third in the past six months, and in one experimental repository attack, 26,000 agents were affected within hours. OWASP has now responded with its Agentic Skills Top 10 — the first comprehensive security framework for agent skills — whose top three risks are Malicious Skills, Supply Chain Compromise, and Overprivileged Skills. As OWASP's Niv Hoffman puts it, "If agents are the new operating system, then skills are the new applications" — and applications need security review.

The scariest part isn't the malicious skills themselves. It's a structural bypass in how skills are loaded. Datadog Security Labs found that dynamic context commands in Claude Code skills execute shell commands during preprocessing — before the model ever sees the skill content. That means model-level prompt injection defenses never get a chance to intervene. Skills can even enter trusted sessions without explicit installation, via project .claude/skills/ folders, plugins, and nested monorepo directories.

Even when the model does see a malicious skill, its defenses are inconsistent. In Datadog's testing, one model version with maximum reasoning refused a malicious skill outright — while a newer version ran the same skill without identifying credential theft. Datadog's researchers are blunt: no model will ever be 100% resistant to prompt injection, because LLMs cannot differentiate trusted instructions from attacker-controlled input.

Meanwhile, the signals developers actually use to pick skills are the wrong ones. A repo with 100,000 stars is popular, but stars are a popularity signal, not a quality review. The most-starred skills — Superpowers at roughly 226,000 stars, the Karpathy guidelines at 174,000 — are impressive, but nothing about those numbers tells you the code is safe.

So what does meaningful scrutiny look like in practice?

• Treat skills like npm dependencies: read SKILL.md before installing, as Anthropic itself recommends treating skills "like installing software."
• Pin every skill to a specific commit SHA so a "safe" version can't silently become a compromised one upstream.
• Inventory what each agent can see — per-agent loadouts limit the blast radius if a skill turns out to be malicious.
• Run automated security scanning and sandboxed benchmarking rather than trusting stars or model refusals.

That last approach is the gap independent verification platforms are being built to fill. SkillzBench, for example, is developing a free directory that pins skill versions to commit SHAs, security-scans every listing, and benchmarks each skill in a sandbox — the same model, with and without the skill — so safety and performance are measured rather than assumed. Until that kind of infrastructure matures, the trust gap remains the defining risk of the 2026 skills ecosystem — and the reason popularity alone should never be your vetting process.

Treat Skills Like Dependencies, Not Prompts

The July 2026 "Paperclip" typosquatting incident saw trojanized skills rack up 300,000+ installs each — while trojanized Python packages were caught within hours, according to Dark Reading's coverage. The difference is telling: package ecosystems have scanners, lockfiles, and maintainers who notice. Skill ecosystems are only now building theirs.

The good news is that expert advice has converged fast. Anthropic's own guidance is blunt: treat skills "like installing software," and use them only from trusted sources, because a malicious skill can direct the agent to execute code in ways that don't match its stated purpose. Practitioners like Max Velloc describe the best skills as "workflow contracts" rather than prompt snippets — versioned commitments an agent must honor, not vibes it may interpret loosely. And OWASP has formalized the whole discipline into its Agentic Skills Top 10, the first comprehensive security framework for agent skills, alongside a Universal Agentic Skill Format v1.0 that carries provenance, permission, dependency, and signature signals designed for automated verification.

What does the dependency-management mindset look like in practice?

• Pin versions. Treat every skill install like an npm dependency — pinned to a specific commit SHA, so an upstream change can't silently alter what your agent executes.
• Check provenance and permissions. OWASP's format signals (signatures, hashes, changelogs) exist precisely so tooling can distinguish legitimate skills from malicious ones automatically.
• Inventory per agent. As Microsoft's Omar Turner warned, most CISOs "can't honestly say how many agents are running and how many skills are embedded within agents."

The missing piece is the trust layer: independent verification that a skill is both safe and actually useful. GitHub stars won't tell you — one popular-skills roundup puts it plainly: stars are "a popularity signal, not a quality review," noting that the Superpowers skill has ~226,000 stars, more than Vue itself. And model-level defenses can't be counted on either; Datadog researchers found one model version refused a malicious skill while another ran it without spotting credential theft.

That's the gap verification platforms are now filling. SkillzBench, for example, is building a free pipeline that pins every skill version to a commit SHA, security-scans it, and benchmarks each one in a sandbox — same model, with and without the skill — publishing the measured Lift in percentage points, alongside a free MCP connector so agents only see the skills you explicitly equip. Skills, proven — that's the standard the ecosystem needs before agent skills can be trusted as real infrastructure.

Your 2026 Skills Playbook: Practical Steps

Theory only gets you so far. By 2026, the teams benefiting most from agent skills are the ones treating them like production dependencies — with inventory, review, and hard limits — not like copy-paste prompts.

Start with the blind spot Microsoft's Omar Turner called out: "Most CISOs can't honestly say how many agents are running and how many skills are embedded within agents." Build a per-agent inventory of installed skills, then keep it current — skill repositories grew by at least a third in six months, so a stale inventory is a useless one.

Next, apply the rule Anthropic itself states: treat every skill like installing software, and read SKILL.md before you install anything. Stars are a popularity signal, not a quality review — the Superpowers skill sits at roughly 226,000 GitHub stars, more than the Vue repo, yet popularity says nothing about security. And per Datadog's research, model-level defenses are unreliable: one Opus version refused a malicious skill; another ran it without spotting credential theft.

Then harden the runtime itself:

• Set disableSkillShellExecution in managed settings, since dynamic context commands can execute before the model ever sees them — bypassing prompt-injection defenses entirely.
• Audit .claude/skills/ folders in every repo; skills can slip into trusted sessions via project directories and monorepos without explicit installation.
• Require code review on any change to .claude/ paths, just as you would for application code.
• Use per-agent loadouts so each agent only sees the skills and tools chosen for it — limiting blast radius if one skill turns malicious.

Prefer version-aware, cross-tool skills where possible. Codex loads Claude plugin marketplaces directly, and package-shipped skills like TanStack Intent update alongside the library, solving the training-cutoff problem. SkillzBench is building per-agent loadouts plus version pinning and security scanning into its free directory and MCP connector for exactly this workflow.

Finally, watch the economics and the "look-done" trap. Claude Code users hit usage limits faster than expected, and three Pro seats (~$60) often beat one Max seat for agentic work. Most critically: always read diffs before merging. An agent can appear productive while quietly skipping the hard part — and an unread diff in production is the most expensive shortcut of all.

Where Skills Go Next - and How to Stay Ahead

Niv Hoffman, co-lead of OWASP's Agentic Skills Top 10, put it plainly: "If agents are the new operating system, then skills are the new applications." If he's right, the next question is obvious — who plays the role that antivirus, app stores, and code review played for the last computing era?

The trajectory points toward formalization. OWASP has already released the first comprehensive security framework for AI agent skills, plus a Universal Agentic Skill Format v1.0 carrying provenance, permissions, and signature metadata designed for automated verification. Expect those standards to mature from advisory documents into baseline expectations, the way SBOMs did for software supply chains.

Expect the harness to keep eating the stack, too. 2026 benchmarks that keep model and wrapper together show that swapping the harness moves results as much as swapping the model weights, and skills are becoming the harness's most portable layer. Vercel's skills CLI already installs skills across 70+ agents, and TanStack ships SKILL.md inside npm packages so guidance updates with the library — a pattern likely to become the default way framework knowledge reaches agents.

The risks scale with the adoption. Trojanized skills in the July 2026 "Paperclip" typosquatting incident accumulated 300,000+ installs each, while equivalent malicious Python packages were caught within hours — proof that the skill ecosystem lacks the immune system package registries slowly built. And because dynamic context commands can execute before the model ever sees a skill, Datadog researchers conclude that model-level prompt injection defenses will never be fully sufficient. Verification has to happen outside the model.

What to watch as 2026 closes out:

• Universal skill formats gaining real adoption, with security signals checked automatically at install time
• Skills shipping inside packages as standard practice, solving the training-cutoff problem
• Enterprises demanding skill inventories — Microsoft's Omar Turner notes most CISOs can't say how many agents and skills they're running
• Independent measurement replacing star counts as the trust signal, since stars are "a popularity signal, not a quality review"

That last trend is where SkillzBench is headed. We're building a free, independent directory that crawls and dedupes skills from GitHub, pins every version to a commit SHA, security-scans and quality-judges each one, and benchmarks every skill in a sandbox — with and without the skill, same model — publishing the Lift in percentage points. A free MCP connector then lets you toggle exactly which verified skills each of your agents can see.

If you want to test skills against real Lift data the moment it's available, join the SkillzBench waitlist — early readers will be first to run the benchmarks.