The State of Agent Skill Security in 2026

A New Dependency Layer With Old Supply Chain Problems

In October 2025, Anthropic introduced a simple idea: package agent instructions as a markdown file. Within weeks, OpenAI, Google, Microsoft, Cursor, and JetBrains adopted the format, and by December the SKILL.md spec was an open standard with 30+ platforms on board — a speed of standardization that dependency ecosystems like npm never achieved.

That speed came at a cost. Fortinet now describes skills as "the new dependency layer," carrying the same supply chain risks as package registries a decade ago — except skills plug directly into agents that hold your credentials, file system, and shell access. As one analysis put it, a compromised skill runs code inside an AI agent that already has your environment.

The security data is sobering. Early 2026 academic research found that more than 26% of publicly available skills contain at least one vulnerability, spanning 14 distinct attack patterns from prompt injection to data exfiltration. Confirmed malicious skills average four distinct attack vectors each, and the ClawHavoc campaign flooded a major registry with 341 malicious skills in just three days — all pointing to a single command-and-control server, with 54% traced to one actor using templated brand impersonation.

What makes skills uniquely dangerous is that they don't need to exploit software vulnerabilities. They simply instruct the agent to exfiltrate keys, download payloads, or disable safeguards. Researchers identified two dominant patterns: "Data Thieves," where an innocent-looking SKILL.md bundles scripts that harvest AWS and SSH credentials, and "Agent Hijackers," which hide instructions in HTML comments or invisible Unicode that code review can't see.

The publishing barrier reflects this immaturity:

• A single markdown file and a week-old GitHub account is enough to publish — no code signing, no review, no sandboxing by default
• None of the major registries support version pinning, so trust granted today says nothing about tomorrow
• Install counts can be inflated through unauthenticated requests, making popularity a manufactured signal
• Most teams have no visibility into which skills are active across their environment

The industry consensus is unambiguous: treat skills as third-party software dependencies, not harmless text. That means version pinning, continuous re-scanning, and least-privilege access — the same rigor applied to package managers and CI/CD pipelines. It's the principle behind how we're building SkillzBench: pinning every skill version to a commit SHA, re-scanning on upstream changes, and testing skills in a sandbox rather than trusting static signals.

The lesson of 2026 so far is that trust, once granted, is silently exploitable — and the ecosystem is only beginning to build the controls that assumption demands.

Why Every Scanner Failed: Point-in-Time Trust Is the Core Flaw

In early 2026, a skill called "brand-landingpage" sailed through security checks from Cisco, Nvidia, and skills.sh — then reached more than 26,000 users before anyone realized it was malicious. The scanners weren't broken. The trust model they implement was.

The payload sat behind a mutable external URL. Every scanner analyzed the skill at a single point in time and issued a clean verdict; the content behind that URL changed afterward, when no one was looking. As first-party research from AIR demonstrated, current scanners all share the same design — static heuristics plus LLM agents reviewing the SKILL.md and bundled resources — so they all shared the same blind spot.

That blind spot is structural, not incidental. Orca Security found that a prominent marketplace scans skills only at creation and again at a popularity threshold, leaving exploitation windows of days or weeks. Worse, the marketplace's own distribution mechanics are attack primitives:

• Install counts inflated trivially via unauthenticated GET requests
• Silent overrides, where a same-name install replaces an existing skill
• Blind bulk updates with no diffs and no version pinning

Three end-to-end attack flows achieved persistent code execution through skills that had passed the platform's own security audits.

Hidden-instruction attacks compound the problem. Researchers documented "Agent Hijacker" skills embedding malicious instructions in HTML comments or invisible Unicode codepoints — text no human code review will catch. One such skill, a code review tool with 312 stars, silently auto-approved "security-exempt" code. Meanwhile, no major registry implements version pinning, and a single actor accounted for 54% of confirmed malicious skills via templated brand impersonation.

The industry's response so far — Fortinet's deterministic pattern matching, designed to resist evasion of LLM-based review, and Anthropic's Claude Code Security preview — acknowledges the problem but doesn't resolve the core tension. Deterministic rules miss time-delayed payloads and environment-gated triggers; LLM review can be evaded by design. No single scanning method, deterministic or LLM-based, is sufficient on its own.

This is why point-in-time trust is the core flaw, not any particular scanner's implementation. A one-time verdict on mutable content is a snapshot of a moving target. Experts now describe skills as "living third-party dependencies" requiring continuous validation — the same rigor applied to npm packages or CI/CD pipelines.

That consensus shapes how SkillzBench is being built: pinning every skill version to a commit SHA, re-scanning when upstream content changes, and combining deterministic security checks with sandboxed behavioral testing rather than relying on any single verdict. Trust should be a continuous process, not a timestamp — and until the ecosystem treats it that way, every skill should be assumed untrusted.

The Industry Responds: OWASP AST10 and the Treat-As-Third-Party-Code Consensus

The good news: 2026 is the year the industry stopped treating agent skills as harmless text files. OWASP published the Agentic Skills Top 10 (AST10), the first comprehensive security framework for this attack surface, documenting the ten most critical risks across all major platforms with evidence-based mitigations. Vendors are building tooling to match.

The responses take different shapes. Fortinet introduced deterministic skills scanning — 24 rules executing in milliseconds, deliberately avoiding LLM-based review because an attacker who crafts a skill to evade an LLM reviewer "gains nothing against deterministic pattern matching." NVIDIA is building NemoClaw, an open-source skill scanning and validation framework in its early stages. Anthropic launched Claude Code Security in limited research preview, betting that defenders who move quickly can find and patch weaknesses before attackers weaponize them.

These efforts respond to a well-documented failure mode. A first-party experiment demonstrated a malicious skill that passed scanners from Cisco, Nvidia, and skills.sh because its payload sat behind a mutable external URL that changed after trust was granted — reaching more than 26,000 users. Meanwhile, academic research found that over 26% of publicly available skills contain at least one vulnerability across 14 distinct attack patterns.

The emerging consensus among security experts is that skills must be governed like living third-party dependencies, not one-time-scanned prompts. That means:

• Continuous validation — "A one-time security scan is no longer sufficient," as one researcher put it, since external content can change after approval.
• Version pinning to immutable references — commit SHAs and cryptographic hashes, because no major registry currently supports version pinning at all.
• Least privilege — skills shouldn't inherit full user data access by default.
• Organizational visibility — in most environments today, you simply don't know what skills are active across your team.

No single scanning method closes the gap. Deterministic rules resist evasion but miss time-delayed payloads; static analysis and LLM reviewers both failed the AIR live-attack test. That's why layered approaches — deterministic scanning plus sandboxed behavioral testing — are becoming the baseline expectation.

It's the model SkillzBench is building around: pinning every skill version to a commit SHA, security-scanning continuously, benchmarking skills in a sandbox with the same model with and without the skill, and surfacing a 0-100 trust score where Lift is always shown separately — because install counts and star ratings, as Orca Security demonstrated, can be trivially manufactured. Treat every skill as untrusted code, because that's exactly what it is.

CTA: Skills, proven. Join the SkillzBench waitlist to get trust scores and real Lift benchmarks the day we launch.

A Practical Defense Model: Continuous Verification, Sandboxed Benchmarks, and Least-Privilege Loadouts

Every major skill compromise in 2026 traces back to the same failure: trust granted once, then never re-examined. The defense model that experts now converge on — continuous verification, sandboxed behavioral testing, and least-privilege access — is designed to break that pattern at every stage.

The first pillar is version pinning. None of the major registries currently pin skill versions, which means an upgrade can silently swap in new instructions or point at changed external content. That's exactly how a malicious skill passed scanners from Cisco, Nvidia, and skills.sh before reaching 26,000+ users — its payload sat behind a mutable URL that changed after approval, according to first-party research from AIR. Pinning every version to a commit SHA makes the artifact immutable and auditable.

The second pillar is layered testing, because no single method suffices. Fortinet deliberately chose deterministic pattern matching over LLM review, reasoning that an attacker crafting a skill to evade LLM-based review gains nothing against deterministic rules. Yet static analysis misses time-delayed payloads and environment-gated triggers. Sandboxed behavioral testing — running skills under controlled conditions and observing what they actually do — is the method that confirmed 157 malicious skills in published academic work, per Mondoo's analysis. Combining both closes gaps neither covers alone.

The third pillar is trust signals that can't be manufactured. Install counts can be inflated with unauthenticated GET requests, and GitHub reputation can be borrowed — the AIR experiment leaned on a repository with roughly 36,000 stars. A defensible trust score draws on security, quality, license, maintenance, and community signals, with performance Lift always shown separately so popularity never masquerades as safety.

The fourth pillar is least privilege. Experts recommend that skills not inherit full user data access, and most organizations today can't even answer which skills are active across their team. Per-agent loadouts solve this: an agent sees only the skills and tools explicitly chosen for it, creating an approved-catalog model with a clear audit trail.

This is the model SkillzBench is building across its five pillars — Discover, Verify, Benchmark, Equip, and Stay current — with continuous re-scanning and re-benchmarking whenever upstream skills change. The scope is stated honestly: full benchmarking for instruction-only skills, link-out listing for script-bearing skills, since bundled credential-harvesting scripts are a dominant malicious pattern.

• Pin every skill version to a commit SHA and re-scan on every upstream change.
• Layer deterministic scanning with sandboxed behavioral testing before trusting anything.
• Weight trust on signals that can't be bought or faked, and show Lift separately.
• Restrict each agent to an approved loadout so no skill inherits the whole environment.

Skills, proven. Join the SkillzBench waitlist to get independent security and performance data on agent skills the moment it ships.

Your 2026 Skill Security Checklist

None of the 2026 research we've covered helps if you don't act on it. With more than 26% of publicly available skills carrying at least one vulnerability, and a single malicious skill reaching 26,000+ users after passing three major scanners, the question isn't whether your agents use risky skills — it's whether you know which ones.

Start with an audit. In most environments today, you simply don't know what skills are active across your team. Inventory every agent you run — Claude Code, Codex, Cursor, Gemini CLI, chat-app agents — and list every SKILL.md package it loads. Then apply these rules:

• Treat every skill as untrusted code until verified. Orca Security put it bluntly: the same rigor applied to package managers and CI/CD pipelines must extend to skill marketplaces — until then, every skill is exactly what it looks like, untrusted code.
• Pin versions and watch upstream changes. No major registry currently supports version pinning, and point-in-time trust has repeatedly failed — one malicious payload sat behind a mutable external URL that changed after scanners approved it. A one-time scan is no longer sufficient.
• Distrust popularity signals. Install counts can be inflated with unauthenticated requests, and GitHub reputation can be manufactured — the AIR researchers borrowed credibility from a repository with roughly 36,000 stars.
• Prefer sandbox-tested skills with published Lift. Behavioral sandbox testing is the method researchers used to confirm 157 malicious skills that static analysis missed. A skill should prove its value with a measured Lift in percentage points, tested with and without the skill on the same model — not with a star count.
• Apply least privilege per agent. Don't let every skill inherit full access to your credentials and environment. Give each agent only the skills and tools it needs.

Doing all of this by hand across multiple agents is exactly the gap SkillzBench is being built to close. It's building continuous verification — pinning every skill version to a commit SHA, security-scanning, and re-checking when upstream changes — plus sandbox benchmarking that publishes Lift separately from trust scores, so money and popularity never touch ratings. Its planned per-agent loadouts let you toggle skills and tools per agent, so each agent only sees what you chose.

SkillzBench isn't live yet, but you can join the waitlist now to get continuous verification, benchmarking, and per-agent loadouts when they launch — and start 2026 knowing exactly what your agents are running. Skills, proven.