What Happens if a Skill Has a Security Vulnerability?

The Real Cost of a Vulnerable Agent Skill

Three lines of markdown in a SKILL.md file were enough to exfiltrate SSH keys, according to OWASP's Agentic Skills Top 10. That single example captures why vulnerable skills deserve more caution than an ordinary buggy package.

Independent audits converge on a striking range: roughly 13% to 26% of published skills carry at least one security vulnerability. A large-scale study of 31,132 skills found 26.1% vulnerable, while a Snyk audit of 3,984 skills found 36.82% with at least one flaw and 13.4% with a critical issue.

What makes skills uniquely dangerous is their inheritance model. A skill runs with the agent's full privileges — shell access, file system read/write, API keys, SSH credentials, wallet files, and messaging. Once approved, it gains persistent permissions without further prompts, a mismatch researchers call the consent gap.

The documented harms are concrete, not hypothetical:

• Credential theft targeting macOS crypto wallets, SSH keys, and browser logins via Atomic Stealer
• Ransomware delivery, including a benign-looking "GIF Creator" skill that silently executed MedusaLocker
• Data exfiltration through indirect prompt injection from poisoned third-party content
• Backdoors that survive uninstallation by writing into CLAUDE.md, MEMORY.md, or settings.json

Persistence is the detail most users miss. Removing a skill does not necessarily remove its instructions, and OWASP documents SOUL.md backdoors that rewrite the agent's identity file. Five of the top seven most-downloaded ClawHub skills at peak infection were confirmed malware — popularity offers no protection.

This is the gap SkillzBench is being built to close: pinning every skill version to a commit SHA, security-scanning and license-checking each one, benchmarking it in a sandbox, and letting each agent see only the skills you deliberately choose through per-agent loadouts.

Why Skills Get Compromised: The Consent Gap and Hidden Attack Vectors

The most dangerous flaw in a skill is often invisible to traditional code scanners. Because agent skills function as both code and natural language, malicious instructions can hide in plain text where static analyzers cannot see. This duality creates a structural blind spot that attackers actively exploit.

Once a user approves a skill, the agent grants persistent permissions to read files, write code, and open network connections without further prompts. This "consent gap" means a single approval unlocks full system access, allowing malicious payloads to execute silently. The mismatch between what users intend and what the skill actually performs is the primary enabler for compromise.

Executable scripts significantly amplify this risk. Research indicates that skills bundling executable scripts are 2.12 times more likely to contain vulnerabilities than instruction-only packages. This statistical spike highlights why bundled code demands stricter scrutiny than pure text instructions.

Attackers also exploit persistence mechanisms that survive uninstallation. Malicious skills can modify core agent files, leaving behind backdoors that continue to operate even after the skill is removed.

< ul class="blog-list">

These persistence vectors mean that removing a suspicious skill is rarely enough to secure the agent. A thorough audit of identity and configuration files is required to ensure the threat is fully eradicated.

Documented campaigns confirm these are not theoretical risks. The ClawHavoc campaign pushed hundreds of malicious skills into marketplaces, with five of the top seven most-downloaded skills confirmed as malware at peak infection. Such coordinated attacks demonstrate that popularity and download counts do not equate to safety.

The ecosystem currently lacks mandatory security review, mirroring the early days of npm and PyPI but with higher privileges. Anyone can publish a skill with minimal barriers, creating a supply chain security problem of unprecedented scale.

SkillzBench is building a free directory and MCP tool to address this gap by continuously verifying skills. The platform focuses on security scanning and version pinning to help users distinguish between helpful tools and risky packages. By tracking upstream changes and re-scanning for new vulnerabilities, it aims to provide the continuous verification that the current market lacks.

Understanding these structural weaknesses is essential for anyone deploying agent skills in production environments.

How to Vet Skills Before You Install Them

The good news: the same research that documents the risk also shows what effective vetting looks like. Since skills inherit your agent's full privileges — shell access, credentials, file systems — treating every unvetted skill as a potential full-privilege compromise is the rational default, not paranoia.

Start with a security scan before you adopt anything. Purpose-built tools like Sentry's skill-scanner check for prompt injection, malicious code, excessive permissions, and secret exposure, while Snyk's mcp-scan achieved 90–100% recall on confirmed malicious skills with zero false positives on legitimate ones. This is exactly why SkillzBench is building security scanning into its free Verify pillar — every skill gets scanned, license-checked, and pinned to a commit SHA before you ever see it.

Version pinning matters more than most people realize. Supply chain attackers compromise previously benign skills through account takeover and repository hijacking, so a skill that was safe last month may not be safe today. Pinning to a specific commit SHA means you know exactly what code you're running, and continuous re-scanning catches upstream changes.

Scrutinize bundled executable scripts hard. Research across 31,132 skills found that skills with executable scripts are 2.12× more likely to contain vulnerabilities than instruction-only skills. Structural vectors like frontmatter hooks and ! command syntax run shell commands automatically — before the model even sees the prompt.

Check what permissions the skill actually requests:

• Read/Grep/Glob — low risk; the skill can look but not act
• Bash/Write/Edit — high risk; the skill can execute and modify anything
• WebFetch combined with the above — near-full access, since the skill can pull external content and act on it

Finally, don't trust popularity, reviews, or verified badges alone. Five of the top seven most-downloaded ClawHub skills at peak infection were confirmed malware, and OWASP warns that "a signature proves authorship, not safety" — a verified publisher can still ship malicious content. A skill that fetches untrusted third-party content (17.7% of ClawHub skills do) can even be compromised without the author doing anything wrong.

Vetting before installation is the single highest-leverage defense, and it's the one step most skill marketplaces skip entirely.

Your Practical Defense Checklist (and Where SkillzBench Fits)

Knowing that roughly a quarter of published skills carry at least one vulnerability turns skill installation from a casual click into a security decision. The good news: a handful of disciplined habits closes most of the attack surface.

Scan before you install. Anthropic's own guidance, cited in academic research, recommends installing only from trusted sources and thoroughly auditing untrusted skills. Purpose-built scanners exist — Snyk's mcp-scan achieved 90–100% recall on confirmed malicious skills, per the company's audit of the ClawHub ecosystem. Never assume popularity means safety: five of the top seven most-downloaded ClawHub skills at peak infection were confirmed malware.

Prefer instruction-only skills. Skills bundling executable scripts are 2.12× more likely to contain vulnerabilities than instruction-only skills, according to the SkillScan study of 31,132 skills. If a skill needs code, scrutinize what it can run — and remember that frontmatter hooks and ! command syntax execute without the model's involvement.

Apply least privilege. Because the "consent gap" grants persistent permissions on approval, configure your agent so a compromised skill can't do maximum damage. OWASP's guidance recommends isolating skill execution in sandboxes, restricting access to agent identity files, and hash-pinning installed skills.

Audit after removal. Removing a suspicious skill may not remove the threat — instructions written into CLAUDE.md, MEMORY.md, settings.json, or hook configurations persist after uninstallation. Check those files manually.

Re-scan on every update. Supply chain attackers compromise previously benign skills through account takeover and repository hijacking, so a skill that was safe last month may not be today.

Here's your practical defense checklist:

• Scan every skill with a security tool before installation — no exceptions, even for popular ones.
• Choose instruction-only skills where possible; treat bundled scripts as a 2.12× risk multiplier.
• Run agents with least-privilege loadouts — the agent sees only what you deliberately enable.
• After removing a suspicious skill, audit CLAUDE.md, MEMORY.md, settings.json, and .mcp.json for leftover instructions.
• Pin versions and re-scan whenever a skill updates upstream.

Doing all of this by hand is workable but tedious. SkillzBench is building an easier path: a free, independent directory where every skill is security-scanned, version-pinned to a commit SHA, and delivered through per-agent loadouts so your agent only sees what you chose — with upstream changes tracked and re-scanned automatically. The platform is currently in pre-launch, and the waitlist at skillzbench.com is open for anyone who wants notified access when it goes live.