Skill Authors Deserve Credit: Towards Verified Creators

Anyone Can Publish an AI Skill — Including Attackers

Here's a sobering thought: publishing an AI agent skill requires nothing more than a SKILL.md file and a GitHub account that's one week old. No code signing, no security review, no sandbox by default. As Snyk researchers put it, this isn't theoretical risk — it's an ecosystem already under attack.

The consequences are no longer hypothetical. The ClawHavoc campaign distributed 1,184 malicious skills through 12 compromised publisher accounts, racking up 247,693 confirmed installations and $2.3 million in stolen cryptocurrency before anyone caught on. At its peak, five of the seven most-downloaded skills on the registry were malicious. This happened on a platform where anyone with a GitHub account can publish, and agents will happily ingest and execute whatever's inside.

The scale of the problem shows up in the numbers, too. Independent audits, using different corpora and methods, converge on an uncomfortable range: roughly 13–26% of skills carry at least one vulnerability. Snyk's audit of 3,984 skills found 534 with at least one critical issue, while NVIDIA's research subset flagged 26.1% as vulnerable — and 5.2% as showing likely malicious intent.

What makes this especially painful is who gets hurt. Attackers exploit anonymity through typosquatting and by republishing skills under new author IDs, effectively stealing both user trust and creator credit from the legitimate authors whose work they copy. A good-faith author can even be blamed for a compromise they didn't cause — Snyk documented cases where a popular, well-reviewed skill compromised users simply by fetching third-party content. The author did nothing wrong; the design did.

That's why verification matters for creators, not just users. The industry is converging on this: OWASP's case studies call for publisher identity verification and reputation systems, while HiddenLayer recommends treating skill integrity the way the software industry treats package integrity — cryptographic signing and verified provenance. NVIDIA has already built a pipeline that scans, evaluates, and signs skills before publication.

For honest skill authors, the current system is a lose-lose: no way to prove your work is yours, no way to stand out from typosquatted copies, and no credit when your skill performs well. This is the gap SkillzBench is being built to close — pinning every skill version to a commit SHA, running security scans and license checks, and benchmarking actual behavior in a sandbox so a skill's real Lift, in percentage points, speaks for itself. Verification protects users from attackers; it also gives legitimate authors the recognition their work has earned.

Why Popularity and Human Review Can't Establish Trust

You cannot eyeball a skill file and know it is safe. Attackers hide instructions in zero-width characters, Unicode steganography, and HTML comments — invisible to human review but fully parsed by the model, according to security researchers who scanned nearly 59,000 skills. Three lines of markdown are enough to exfiltrate SSH keys, a technique documented in OWASP's agentic skills case studies.

Popularity fails as a trust signal too. Even Microsoft's official azure-skills and Vercel's find-skills — each with millions of downloads — have been flagged for transparency gaps and elevated risk, per the same large-scale registry scan. Download counts measure attention, not behavior.

The scale of the problem is real:

• Independent audits found roughly 13–26% of skills carry at least one vulnerability, with methodology and severity definitions varying across corpora.
• The ClawHavoc campaign distributed 1,184 malicious skills through 12 compromised publisher accounts, reaching 247,693 installations before takedown.
• Daily skill submissions jumped from under 50 to over 500 in a matter of weeks — outpacing any manual review process.

Good-faith authors get caught in the crossfire. Snyk documented a case where a legitimate, well-reviewed skill was compromised because it fetched third-party content at runtime — the author did nothing wrong, yet users blamed the skill. Attackers also republish under new author IDs and typosquat trusted names, stealing credit and trust from the creators who earned it.

Verification has to be behavioral, not reputational. SkillzBench is building exactly that: pinning every skill version to a commit SHA, security-scanning and license-checking each one, and benchmarking real performance in a sandbox with the same model, with and without the skill. That is how honest authors earn visible, verifiable credit — and how readers stop guessing.

The Industry Is Converging on Verified Publishers

Good news is rare in security reporting, but this is one of those moments: the skills ecosystem is starting to fix its identity problem, and the fix looks like verification.

Multiple independent security organizations have landed on the same prescription. OWASP's Agentic Skills Top 10 lists publisher identity verification as a core lesson from documented incidents, alongside publisher reputation systems and pre-publication review. HiddenLayer goes further, recommending that skills be treated like software packages: cryptographically signed, with verified provenance, and accepted by agent runtimes only when signed by a known, trusted publisher.

The industry isn't waiting for consensus documents. NVIDIA has already built a Verified Skills pipeline that scans, evaluates, and signs agent skills before publication. ClawHub itself, after the ClawHavoc campaign saw 1,184 malicious skills distributed through 12 compromised publisher accounts, adopted mandatory security reviews, publisher identity verification, and automated malware scanning. Cisco, Mondoo, and Snyk have all shipped skill-scanning tooling as well.

And the evidence shows automated verification genuinely works at scale. Snyk's detectors hit 90–100% recall on confirmed malicious skills with 0% false positives on legitimate ones — a reminder that hidden threats like zero-width character steganography are invisible to human review but catchable by machines.

• OWASP: require identity verification for skill publishers; only install from verified sources
• HiddenLayer: cryptographic signing and verified provenance, app-store-style review before publication
• NVIDIA: a working pipeline that scans, evaluates, and signs skills pre-publication
• Snyk: automated detectors achieving 90–100% recall with zero false positives

Here's the part that gets overlooked: verification is a win for creators, not just users. Attackers thrive on anonymity — typosquatting legitimate names, hijacking publisher accounts, republishing malicious skills under fresh author IDs. Every one of those tricks also steals recognition from the honest author whose name or skill was imitated. Verified identity is the mechanism through which trustworthy skill authors finally get credit for work that currently disappears into an anonymous pile.

This is exactly the direction SkillzBench is building toward: pinning every skill version to a commit SHA, security-scanning, license-checking, and publishing a trust score — with benchmark Lift shown separately, and everything free. Verification protects the people installing skills. It also gives the people writing them something they've never had: proof of who they are.

If you want to follow this space — and get skills you can actually trust the moment verification tooling goes live — join the SkillzBench waitlist. Skills, proven.

How SkillzBench Is Building the Credit System Authors Deserve

Every verified skill needs a verifiable author behind it. That's the principle guiding what SkillzBench is building: an infrastructure where honest skill authors finally get the recognition attackers are currently stealing from them.

The problem is well documented. Snyk's audit of nearly 4,000 skills found malicious skills republished under new author IDs, and the OWASP case studies describe the ClawHavoc campaign distributing 1,184 malicious skills through 12 compromised publisher accounts and typosquatting. Meanwhile, large-scale scanning of 58,983 skills found only 20% fully clean. Legitimate creators lose twice: their names get hijacked, and the resulting chaos erodes trust in everyone's work.

SkillzBench's approach, now in pre-launch development, maps directly onto what OWASP explicitly recommends: publisher verification, source verification, and reputation systems. The platform pins every skill version to a commit SHA, so a skill is always traceable to its true source. Automated security scanning and license checks run continuously, because human review alone misses hidden instructions embedded via zero-width characters and Unicode steganography.

What SkillzBench is building includes:

• Commit-SHA pinning — every version tied to its true origin, making impersonation and silent tampering visible
• Sandbox benchmarking — each skill tested with the same model, with and without it, publishing the Lift in percentage points, always shown separately from ratings
• Trust scores from 0 to 100 built from security, quality, license, maintenance, and community signals — and money never touches them
• Continuous upstream tracking: when a skill changes, it gets re-scanned and re-benchmarked

Behavior-based benchmarking matters because code-clean skills can still be behaviorally compromised — HiddenLayer notes that audits can miss subtle issues like an affiliate link quietly inserted into every recommendation. Measuring actual behavior closes that gap.

Both sides win. Users get proof that a skill is safe and effective before equipping it. Authors get verified attribution instead of watching typosquatters trade on their names. And everything — the directory, the benchmarks, the alerts, and the free MCP connector that links any agent to the skills you choose — stays free, funded by advertising that never influences scores.

SkillzBench is being built right now. Join the waitlist at skillzbench.com and be first in line when verified skills, proven, go live.