Are Agent Skills Safe? What the Research Found and How to Install Skills Securely

Why this matters

An agent skill is a set of instructions your AI will follow. That is what makes skills useful, and it is also what makes them dangerous when they come from the wrong place. A malicious skill does not need to exploit a bug. It just needs to be installed, because the agent will do what it says.

In early 2026 that stopped being hypothetical. Security researchers audited thousands of public skills and found a meaningful share with real flaws, and a smaller number that were built to steal credentials or install backdoors. This post explains what the research found, how a skill can hurt you, and a short checklist for installing skills safely - whether you use Claude, ChatGPT, Cursor, or any other agent on the open standard.

What the research found

The most cited study is Snyk's ToxicSkills report, published February 5, 2026. Snyk's researchers analyzed 3,984 skills on ClawHub, a public registry for the OpenClaw agent. The headline numbers:

• 36.82% of skills (1,467) had at least one security flaw.
• 13.4% (534 skills) had at least one critical-level issue.
• 76 skills were confirmed malicious after human review, and 8 of them were still publicly available when the report went out.
• 10.9% of skills contained hardcoded secrets - API keys, tokens, and passwords baked into the file.
• 17.7% pulled in third-party content the user had no visibility into.

Among the confirmed malicious skills, 91% used prompt injection - instructions hidden from a human reader but visible to the model, using tricks like base64 encoding, Unicode smuggling, and the classic "ignore previous instructions" pattern.

A separate analysis cited in the Agentman ecosystem report scored 47,150 public skills on quality and found an average of 6.2 out of 12. Most public skills are not malicious. Many are simply not very good, which is its own kind of risk when you are trusting one with real work.

How a bad skill actually hurts you

Three attack patterns showed up repeatedly in the malicious samples.

Malware delivery. The skill instructs the agent to download and run something - in several cases a password-protected ZIP, chosen because archives with passwords slip past automated scanners. The agent, following instructions, unpacks and executes it.

Credential theft. The skill includes an obfuscated command that reads environment variables, config files, or saved tokens and sends them to an outside server. Because the command is encoded rather than written in plain text, it does not look like exfiltration to a person skimming the file.

Persistence and security disablement. The nastiest samples modified system service files to install a backdoor that survives a restart, or turned off security tooling so later stages would go unnoticed.

None of these require a vulnerability in the agent. They work because the agent is doing its job: reading instructions and carrying them out. This is why the usual advice - "just read the SKILL.md before you install it" - is necessary but not sufficient. Obfuscated payloads are designed to survive a human read.

Why skills are different from MCP servers

If you have set up an MCP connection you have probably thought about permissions: what can this thing read, what can it write. Skills need a different mental model.

An MCP server is a program with credentials. The risk is scope. A skill is text the agent obeys. The risk is trust. The question is not "what can this access" but "who wrote this, and would I let them give my agent instructions?" Because skills can also instruct the agent to use the MCP connections it already has, a bad skill inherits every permission you have granted elsewhere.

A checklist for installing skills safely

None of this means you should avoid skills. Curated skills lift agent task performance by a wide margin in the same research that found the problems. It means you should install them the way you would install a browser extension: from sources you trust, sparingly, and with a glance at what they ask for.

1. Prefer sources that scan and review. A registry that accepts any upload will contain malicious uploads; the ToxicSkills numbers are the proof. A marketplace that reviews skills before listing them and runs automated security analysis removes most of the risk before you see the file. Every skill on AgentVolt is expert-built or reviewed, and security-scanned before it goes live.

2. Read the SKILL.md anyway. Especially the parts that reference scripts, URLs, or shell commands. If a skill for writing cold emails wants to run a script or fetch something from a domain you do not recognize, stop.

3. Be suspicious of encoded content. Long base64 strings, odd Unicode, or text that looks like noise inside a Markdown file are red flags. Legitimate skills are readable.

4. Check for hardcoded secrets. A skill should never ship with an API key inside it. If it does, the author either does not know what they are doing or wants you to use a key they control.

5. Install fewer skills. The research found two or three focused skills per task outperform sprawling bundles. Fewer skills also means a smaller surface to audit. Remove anything you have not used in a month.

6. Scope what the agent can reach. If a skill only needs to rewrite text, run it in a session without file-system or shell access. Most agents let you limit tools per session, and the experimental allowed-tools field in the skill spec exists so authors can declare what a skill should be permitted to use.

7. Rotate credentials if you installed from an open registry. Snyk's own recommendation for anyone who pulled skills from ClawHub before February 2026 is to audit what is installed and rotate any credentials those skills could have touched. The same logic applies to any unvetted source.

What "security-scanned" should mean

The phrase is easy to put on a landing page, so it is worth knowing what to ask for. A credible scan looks for injected instructions (including encoded ones), shell commands and script execution, outbound network calls and the domains they target, hardcoded secrets, and references to files outside the skill folder. Human review on top of that catches what pattern-matching misses - a skill that is technically clean but does something the description does not disclose.

If a source cannot tell you what its scan covers, treat its skills as unscanned.

Frequently asked questions

Are agent skills safe to install?

Skills from a vetted, scanned source are as safe as any other reviewed software. Skills from open registries are a mixed bag: Snyk found security flaws in about 37% of the public skills it tested and confirmed 76 malicious ones. The source matters more than the format.

Can a skill steal my API keys?

Yes, if it contains instructions to read and send them and your agent has access to where they are stored. This is the most common malicious pattern found in the research. Install from reviewed sources and limit what the agent can reach.

Is SKILL.md itself insecure?

No. The format is plain Markdown and does nothing on its own. The risk is entirely in what a specific file instructs the agent to do, which is why the review and scanning of individual skills matters.

Do these risks apply to Claude, ChatGPT, and Cursor equally?

The format is the same across all of them, so a malicious skill is malicious everywhere. What differs is how much each agent can do on your machine - a coding agent with shell access has a bigger blast radius than a chat app.

The short version

Skills are worth using. Install them from somewhere that reads them first, keep your list short, and never let a skill you have not looked at run a command. That is most of skill security in three sentences.

Browse security-scanned skills on AgentVolt - every skill reviewed before it is listed, and installable in Claude, ChatGPT, Cursor, and 40+ other agents.