Unreviewed Community Agent Skills Hold
Overview
Unreviewed community agent skills, rules, and MCP bundles behave like unaudited supply chain dependencies. They can exfiltrate secrets, run destructive tools, or inject prompts (Snyk, Claude Agent Skills).
Hold installing skills from marketplaces without security review, signing, and version pinning equivalent to production dependencies.
Adoption Signals
These are signals that the anti-pattern is being exploited, not reasons to adopt it.
- Snyk's ToxicSkills audit (5 February 2026) of 3,984 skills found 534 with critical-level issues and 1,467 with at least one flaw, including prompt injection, malware distribution, and exposed secrets (Snyk).
- Koi Security reported on 2 February 2026 that 341 of 2,857 audited ClawHub skills were malicious; 335 of them belonged to the ClawHavoc campaign, disguised as crypto tools, YouTube utilities, and ClawHub typosquats (The Hacker News).
- The first malicious MCP server seen in the wild,
postmark-mcp, turned hostile in version 1.0.16 (17 September 2025) by BCC-ing every sent email to an attacker, after 1,643 downloads (The Hacker News). - Anthropic's own documentation says to use skills only from trusted sources and to audit every bundled file before use (Claude Agent Skills).
- The MCP specification's security guidance requires clients that offer one-click local server setup to show the exact command before running it, and recommends sandboxing with minimal default privileges (MCP security).
Risks
- Full agent privileges. Snyk notes skills inherit the agent's permissions, including shell and credential access (Snyk); one bad skill compromises every repository and secret the agent can reach.
- Social-engineered prerequisites. ClawHavoc skills looked professional and asked users to run an obfuscated shell script or download a trojanised archive as a "prerequisite" (The Hacker News).
- Benign today, malicious tomorrow.
postmark-mcpbehaved normally until one line changed in a later version (The Hacker News); unpinned installs pick up such changes automatically. - Instructions fetched at run time. Skills that pull content from external URLs can receive new malicious instructions after review (Claude Agent Skills).
- Registry moderation lags. Eight of Snyk's confirmed malicious skills were still public on ClawHub at publication (Snyk), and ClawHub's response relies on user reports (The Hacker News).
Pros & Cons
Advantages
- Public registries such as ClawHub and skills.sh offer thousands of ready-made skills that install in one step, which is faster than writing and reviewing internal ones.
- Agent Skills is an open, portable format supported by several agents, including Cursor and Claude, so one install appears to add capability across a team's whole toolset.
- A skill looks like a markdown instruction file, so it feels harmless compared with installing a binary, even though it can bundle scripts the agent will run.
Disadvantages
- Snyk scanned 3,984 skills from ClawHub and skills.sh in February 2026 and found critical issues in 13.4%, at least one security flaw in 36.82%, and 76 confirmed malicious skills.
- Koi Security found 341 malicious skills among 2,857 on ClawHub, most of them delivering the Atomic Stealer (AMOS) infostealer through fake "prerequisite" install steps.
- A skill runs with the full permissions of the agent it extends, including shell and credential access, and even a trustworthy skill can turn hostile when an external dependency or a later version changes.
Recommendation
Hold installing agent skills, rules, or MCP bundles from public registries without review. Treat each one as a production dependency: read every bundled file, pin it to a commit hash or exact version, scan it (Snyk's mcp-scan is one option), and publish approved versions through an internal allowlisted source such as a private Claude Code Plugin Marketplace (Trial on this radar). Run agents that use third-party skills inside sandboxed environments with restricted network egress (see Sandboxed Execution for Coding Agents, Trial).
For skills already installed, inventory them across developer machines and CI, remove anything unreviewed, and rotate credentials the agent could reach if a flagged skill was present. Agent Skills as a format remains in Assess; this entry is about the unreviewed sourcing practice, not the format.
Sources
Consulting
From radar to implementation
You have assessed the technologies — we help you bring them into production systems safely and measurably.
