The Agent Security Series
AI agents now install "skills" the way developers install packages — from open marketplaces, uploaded by strangers. When one of those skills is booby-trapped, it runs with your agent's full access. Here is how the attack works, what it has already done, and how to shut it down.
Definition
Skill poisoning is a supply-chain attack against AI agents in which malicious instructions or code are hidden inside an agent skill — a reusable package of natural-language instructions plus scripts. When the agent loads the skill, the hidden logic executes with the agent's own privileges: its files, terminal, saved credentials, and connected tools.
Key takeaways
Agent skills solved a real problem. Instead of stuffing every possible instruction into a system prompt, teams package procedural knowledge into small folders — a SKILL.md file describing what the skill does and when to use it, plus optional scripts. The agent discovers the skill by its name and description, then loads the full instructions only when a task needs them.
This is efficient and composable. It also created a new trust boundary that most security teams have never had to defend. A skill is not passive data the agent reads with suspicion — it is guidance the agent is designed to obey, and it runs with the agent's own permissions over files, shell commands, credentials, and tools.
Then came the marketplaces. Public registries let anyone publish a skill and anyone else install it in one step, with the social proof of a shared registry doing the rest. Most listings are uploaded by strangers with little vetting. That is the same setup that produced dependency-confusion and typosquatting attacks in the npm and PyPI ecosystems — now pointed at an execution layer with far more reach.
The two are cousins, and the difference is exactly why skill poisoning is harder to stop.
In prompt injection, an attacker hides instructions inside content the agent reads at runtime — a web page, an email, a PDF. Agents are increasingly trained to treat that content as untrusted, and defenses run at the front of the loop, screening what comes in.
A skill sits on the other side of the trust boundary. The agent is built to follow it, it is invoked across many future tasks, and it survives context resets because it lives on disk. Researchers describe skill poisoning as malicious-instruction competition inside an instruction-like carrier: the poison is not obviously foreign text, it is dressed as legitimate workflow guidance. That is why surface-level filtering fails on precisely the cases that matter most.
Most documented attacks follow the same shape. The payload is often a persuasive document, not a single obvious binary — which is what makes it slip past both humans and scanners.
The attacker uploads a skill with a legitimate name, description, icon, and often real working behavior. It may typosquat a popular skill's name to catch installs.
Malicious logic is embedded in the skill's instructions or scripts — frequently split across multiple files, or staged as an innocuous-looking "setup" or "prerequisites" step, sometimes behind an obfuscated blob.
Poisoned metadata can inflate the skill's ranking so the agent selects it over a legitimate tool. The user's benign request quietly routes through the attacker's skill instead.
The skill runs with full access to local files, credentials, API keys, and connected tools — enabling credential theft, data exfiltration, or a persistent backdoor.
Because the skill stays installed, it re-activates across sessions. In multi-agent setups, a poisoned skill ingested as a template can propagate through the system's own generation loop.
Skill poisoning is not theoretical, and it is not new. In early 2026, Koi Security audited 2,857 skills on the ClawHub marketplace and found 341 malicious entries — 335 of them traced to a single coordinated operation, nicknamed ClawHavoc. The campaign used social engineering and obfuscated setup instructions to install credential-stealing malware. Antiy CERT's later analysis of historical uploads put the total at 1,184; Bitdefender's deep scans estimated 800–900. The numbers differ because the lenses differ — the trend does not.
The concentration is the signal. This was not a random trickle of junk — it was a playbook executed at scale. And the picture has not improved since. In June 2026, Air Security scanned 142,836 live skills and flagged 17,822 of them across 6.7 million installs; a researcher-built malicious skill reached over 26,000 agents while every scanner cleared it. Trail of Bits bypassed every public skill scanner it tested in under an hour.
The governance response has already arrived. On 27 April 2026, OWASP published a dedicated Agentic Skills Top 10, naming AST01 Malicious Skills and AST02 Supply Chain Compromise as critical categories, and citing ClawHavoc and Snyk's ToxicSkills audit as the defining incidents. Its prescribed mitigations are Merkle root signing and registry scanning — treating every skill publication as a cryptographically verifiable event. The framework exists. The question is no longer whether this is real; it is whether your organisation has acted on it.
The clearest early-warning signal is academic. Preprints on agent-skill attacks and defenses went from a trickle in January 2026 to a steady stream by mid-year, with new papers still landing in late June — SkillFortify, SkillSieve, RouteGuard, SkillHarm, PhantomSkill, and more.
Agent-skill security preprints, 2026
Approximate count of arXiv preprints on agent-skill attacks & defenses, by month
// Counts are an approximate reading of arXiv cs.CR / cs.AI preprints on agent-skill
// attacks and defenses. Trend, not a precise index. Momentum is the point.
When research volume climbs like this while mainstream coverage stays near zero, the vocabulary is still forming. By the time the term reaches a security-vendor headline or an analyst report, the defensive posture that matters will already have been decided by the teams paying attention now.
No single control is sufficient. Layer these, in roughly this priority order.
The checklist above is only useful if you know where you actually stand. Answer six questions about how your agents are deployed today. Nothing is sent anywhere — this runs entirely in your browser.
Skill Poisoning Exposure Index
Six dimensions, scored 0–10. Higher means more exposed.
Exposure index
Answer all six questions to generate your exposure profile.
0 / 6 answered
// Method: each answer maps to a 0–10 exposure score. The index is the mean of six
// dimensions. This is a directional self-assessment for planning conversations —
// not a substitute for a security audit. Nothing you enter leaves this page.
The architectural answer
Every one of these controls gets easier when the agent, its skills, and its data never leave your perimeter. The entire attack class exists because agents pull skills from public marketplaces run by strangers. Remove that dependency and you remove the primary vector.
That is the design principle behind the modelcam AI engine — Modelcam's on-premise AI appliance. A curated, vetted skill supply chain, running inside your own infrastructure, with provenance and least-privilege built in rather than bolted on. Your agent's capabilities should come from a registry you govern, not from ClawHub.
This briefing draws on primary security research and marketplace audits from 2026. Key references: