Are Agent Skills Safe? Risks, Real Incidents and How to Check One

Short answer: an agent skill is as safe as the person who wrote it and the access your agent has. A skill is a set of instructions, and often scripts, that your agent follows with its own permissions. Most skills are harmless, but security researchers have found hundreds of malicious ones in open registries. Anthropic's advice is to use skills only from trusted sources and to audit anything else the way you would audit software before installing it.

This page explains what a skill can do, the main kinds of risk, what has actually been found, and what to do about it. Figures are quoted as the original reports state them, as of Oct 30, 2026.

What a skill can do with your agent

A skill is a folder with a SKILL.md file. The agent reads the SKILL.md body into its context when a task matches, then follows it. That alone is enough to cause harm, because the agent treats those instructions as guidance for real tool calls. Depending on the agent, a skill can also do the following.

Bundled scripts. The open Agent Skills spec gives skills an optional scripts/ folder of executable code. Anthropic's docs say Claude runs these scripts through bash and sees only their output, not their code. In Claude Code, skills have the same network access as any other program on your computer. On the Claude API they run in a sandboxed container with no network access.

Pre-approved tools. The allowed-tools frontmatter field lists tools the agent may use without asking you. The spec marks the field experimental, and agents handle it differently. In Claude Code the grant lasts for the turn that invokes the skill. Claude Code's docs warn that a skill can grant itself broad tool access, and that workspace trust does not gate the field for skills checked into a repository.

Hooks and shell commands. In Claude Code, a skill's hooks frontmatter registers hooks when the skill is invoked, and they keep running for the rest of the session. A line starting with !`command` runs a shell command before the skill's content reaches Claude, and the output replaces the line.

External URLs. A skill can tell the agent to fetch a page or download a file. Anthropic warns that fetched content might contain malicious instructions, and that even a trustworthy skill can be compromised if its external dependencies change.

The five kinds of risk

1. Prompt injection in the instructions. A SKILL.md can tell the agent to ignore safety rules, hide what it is doing, or behave differently on certain inputs. Anthropic's enterprise guide rates these "instruction manipulation" patterns as high concern, because they can bypass security controls. They are plain language, so code scanners can miss them.

2. Malicious or careless scripts. Anthropic rates scripts in a skill as high concern, because they run with full access to the environment.

3. Data exfiltration. A skill that reads sensitive files and then sends, writes or encodes them somewhere is the pattern Anthropic tells reviewers to look for, including leaks through the agent's own replies.

4. Supply chain and update drift. A skill can look fine on the day you review it and change later, or its download link can start serving something else. The OWASP Agentic Skills Top 10 lists Supply Chain Compromise (AST02), Untrusted External Instructions (AST05) and Update Drift (AST07) as separate risks, alongside Malicious Skills (AST01), which it describes as often disguised as legitimate tools.

5. Licence. This one is legal, not technical. Code with no licence is under exclusive copyright by default, so a skill without a licence gives you no clear right to copy or modify it. Check the licence before you build on a skill or ship it to a team.

The OWASP Agentic Skills Top 10 is the fullest public list of skill risks. Its other entries are Over-Privileged Skills, Insecure Metadata, Weak Isolation, Poor Scanning, No Governance and Cross-Platform Reuse. OWASP lists it as an incubator project, version 1.0 (2026 Edition).

What researchers have actually found

Three studies from early 2026 give real numbers. They used different methods and different samples, so don't add them up or compare them directly. The Cloud Security Alliance's June 2026 briefing for security leaders draws on the same body of research.

Antiy CERT: the ClawHavoc campaign on ClawHub

Antiy CERT's report of Feb 6, 2026 identified 1,184 malicious skill packages in the history of ClawHub, the OpenClaw skill registry, uploaded by 12 author IDs. One author uploaded 677 of them. The malicious addresses sat in sections titled "Prerequisites" or "Setup", which told users to install a "helper tool" before the skill would work. On macOS the payload was the Atomic macOS Stealer (AMOS).

Snyk: ToxicSkills

Snyk scanned 3,984 skills from ClawHub and skills.sh as of Feb 5, 2026. It reported that 36.82% (1,467 skills) had at least one security flaw and 13.4% (534) had at least one critical-level issue. Human review confirmed 76 malicious payloads. Snyk says 100% of the confirmed malicious skills contained malicious code patterns, and 91% also used prompt injection.

Agent Skills in the Wild (arXiv, January 2026)

Academic researchers collected 42,447 skills from two marketplaces and analysed 31,132 of them with an automated detector. They report that 26.1% contained at least one vulnerability. Data exfiltration (13.3%) and privilege escalation (11.8%) were the most common, and 5.2% showed high-severity patterns that suggest malicious intent. Skills that bundled executable scripts were 2.12 times more likely to contain vulnerabilities than instruction-only skills. The detector's stated precision is 86.7%, so treat these as estimates.

What the numbers mean: a "flaw" or "vulnerability" in these studies is a risky pattern, not proof of bad intent. Confirmed malware is a much smaller share. But it is real, it sat in public registries people install from, and it relied on users following setup steps without reading them.

How to check a skill before you use it

Our post "5 checks before you approve a SKILL.md" is the hands-on checklist: read SKILL.md, open every bundled file and link, check what the frontmatter grants, pin the version you reviewed, and verify the publisher and licence. Use it every time.

Beyond the checklist:

Weigh the risk by what the skill contains. Anthropic's enterprise guide rates scripts, URLs and network calls, references to MCP tools, and hardcoded credentials as high concern. Paths outside the skill folder and instructions to run bash are medium. A short instruction-only skill with none of these is a much smaller review.

Run unfamiliar scripts in a sandbox first. Anthropic's review checklist says to run them in a sandboxed environment and confirm that what they do matches the skill's description.

Treat every update as a new install. Anthropic's guidance is to pin skills to specific versions in production and give every update a full security review.

Use the controls your agent has. In Claude Code, the disableSkillShellExecution setting stops !`command` lines from running for skills from user, project, plugin and additional-directory sources. When an organisation sets allowManagedPermissionRulesOnly in managed settings, Claude Code ignores allowed-tools in project and personal skills. Claude Enterprise organisations can turn on skill and plugin security scanning for skills uploaded in claude.ai and Claude Cowork. Anthropic says it does not cover skills uploaded through the Skills API.

Don't rely on a scanner alone. OWASP lists Poor Scanning (AST08) as a risk of its own, because pattern matching misses attacks written in plain language. Anthropic says its scanning complements its review checklist but doesn't replace it. To find scanner skills, search Skill Store 33 for "scan a skill for prompt injection", then read whatever you pick with the same care.

What Skill Store 33's labels mean

Each skill page on Skill Store 33 shows the publisher, the source repository, the licence and a verification state. The states are:

Not yet verified: the store has not tested the skill.

Safety scanned: the skill has had a safety scan only.

Verified: the skill's own tests ran in a sandbox and passed. The store's wording is "Nothing more." It is not a security audit, and it doesn't tell you the tests were thorough.

Tests failing: the skill's own tests ran and did not pass.

Be clear about where things stand: almost every one of the store's roughly 60,000 skills is imported from public sources, mainly the skills.sh index of public GitHub repositories, and is not yet verified. Treat them as you would any public repository, and use the checks above.

FAQ

Can an agent skill steal my data?

Yes, if it is malicious and your agent can reach the data. A skill runs with your agent's access, so its instructions or scripts can read files and send them out. Anthropic lists data exfiltration as a key risk, and it was the most common vulnerability pattern in the arXiv study of 31,132 skills.

Is a skill just a Markdown file?

Not always. SKILL.md is Markdown, but the folder can also hold scripts the agent runs and links to outside content. In Claude Code it can also declare allowed-tools, hooks and shell commands that run when the skill loads. A skill that bundles scripts needs a closer look.

Are skills from Anthropic or other big vendors safe?

Anthropic's own advice is to use skills you created or got from Anthropic, and to audit anything else thoroughly. A well-known publisher lowers the risk, but you should still check that the skill really comes from them and pin the version you reviewed.

Does a Verified badge mean a skill is safe?

No. On Skill Store 33, Verified means the skill's own tests ran in a sandbox and passed, nothing more. It is a useful signal that the skill works as its author intended, not a security review.

Related guide: What Are Agent Skills? SKILL.md Explained for AI Agents

Let your agent search Skill Store 33

Sources

Anthropic, Agent Skills overview (Security considerations; Runtime environment constraints), https://platform.claude.com/docs/en/agents-and-tools/agent-skills/overview (read Oct 30, 2026)

Anthropic, Skills for enterprise (risk tiers, review checklist, skill content scanning, versioning), https://platform.claude.com/docs/en/agents-and-tools/agent-skills/enterprise (read Oct 30, 2026)

Claude Code docs, Extend Claude with skills (allowed-tools, hooks, shell command injection, disableSkillShellExecution), https://code.claude.com/docs/en/skills (read Oct 30, 2026)

Agent Skills specification (scripts/, allowed-tools), https://agentskills.io/specification (read Oct 30, 2026)

OWASP Agentic Skills Top 10, https://owasp.org/www-project-agentic-skills-top-10/ and https://owasp.github.io/www-project-agentic-skills-top-10/README.md (read Oct 30, 2026)

Antiy CERT, ClawHavoc: Analysis of Large-Scale Poisoning Campaign Targeting the OpenClaw Skill Market for AI Agents (Feb 6, 2026), https://www.antiy.net/p/clawhavoc-analysis-of-large-scale-poisoning-campaign-targeting-the-openclaw-skill-market-for-ai-agents/

Snyk, ToxicSkills study of agent skills (Feb 5, 2026), https://snyk.io/blog/toxicskills-malicious-ai-agent-skills-clawhub

Liu et al., Agent Skills in the Wild: An Empirical Study of Security Vulnerabilities at Scale, arXiv:2601.10338 (Jan 2026), https://arxiv.org/abs/2601.10338

Cloud Security Alliance, 5 Claude Agent Skills Risks Every CISO Should Know (Jun 25, 2026), https://cloudsecurityalliance.org/blog/2026/06/25/5-claude-agent-skills-risks-every-ciso-should-know

Choose a License, No License, https://choosealicense.com/no-permission/ (read Oct 30, 2026)

Skill Store 33, verification badge wording, https://ss33.ai/skills (read Oct 30, 2026)

This article was created with the help of AI (AI-Assisted). Every config key, figure and quote was checked against the official docs and primary reports in the Sources list. ReadyAI is accountable for the content.

Keep reading