Why you should not install unvetted AI agent skills

An agent skill is a text file that your agent reads as instructions and then carries out with whatever access you gave it: your files, your terminal, your keys, sometimes a wallet. That is the whole risk. Researchers who audited public skill registries early in 2026 found hundreds of skills that installed malware or sent credentials away, and in our own test the instruction that fooled a Claude agent was never the one that shouted; it was a step that seemed to belong to the task. In a skill, every step seems to belong to the task. Before you install an unvetted skill, read every file in it, search it for the patterns below, and run it first with tools switched off.

A skill is an order, not a document

A web page that your agent happens to open is untrusted content it may or may not act on. A skill is different in kind: you load it on purpose, and the reason it exists is that the agent does what it says. Language models have no reliable way to tell whose instruction they are reading. Simon Willison puts the reason plainly: everything the model sees ends up glued into one sequence of tokens, so a command from a file weighs much the same as a command from you. OWASP ranks prompt injection as the first risk on its list for LLM applications.

The vendors say so themselves. Anthropic's documentation on Agent Skills tells you to use skills only from trusted sources, meaning ones you wrote or got from Anthropic, to audit anything else thoroughly, and to treat installing one like installing software. The same page notes that in Claude Code a skill has the network access of any other program on your computer. Jason Meller of 1Password summed up the point in four words: "Markdown is an installer".

There is a second door besides the text. A skill folder can carry scripts, and Claude Code lets a skill embed shell commands with its ! dynamic-context syntax. Datadog Security Labs showed that those commands run before the rendered skill reaches the model, so no defence that lives in the model or in its prompt gets a say. In their test the model recognised a credential-stealing skill and refused it, and that refusal would have come too late for a command in that position. They also point out that a cloned repository can bring its own skills folder with it, with no marketplace involved, and that organisations can switch this shell execution off in managed settings.

What has already happened

None of this is theory. A few documented cases from the last two years:

ClawHub, February 2026. Koi Security audited all 2,857 skills on ClawHub, the public registry for the OpenClaw agent, and found 341 malicious ones, 335 of them from a single campaign it named ClawHavoc. The lure was a "Prerequisites" section that asked the user to install something first; on macOS the payload matched the Atomic Stealer family. Two weeks later, with the registry past 10,700 skills, their count stood at 824.
The most downloaded skill. 1Password found that the top download on ClawHub at the time, a skill for Twitter, opened by asking for a "required dependency" whose install links led to macOS infostealer malware.
The top-ranked skill. Cisco ran a skill that had been pushed to first place in the repository and found nine security issues. It told the agent to send data to its author's server with a silent curl command, and it told the agent to skip its safety rules so the command would run without asking. Rank and downloads can be manufactured.
A scan of 3,984 skills. Snyk checked skills from ClawHub and skills.sh: 534 of them, or 13.4%, had at least one critical issue, human review confirmed 76 malicious payloads, and 91% of the malicious skills paired ordinary malware with prompt injection aimed at the agent.
An academic study. Researchers verified 98,380 skills from two registries and confirmed 157 as malicious; more than half came from one actor imitating known brands, and the registries removed all 157 after disclosure.
Version sixteen. Not a skill, but the same lesson about trust that changes over time: postmark-mcp, an npm package that let agents send e-mail, worked cleanly for 15 versions, and then version 1.0.16 added one line that copied every message to an outside address.
Text nobody can see. Pillar Security hid instructions in rules files for Cursor and GitHub Copilot using zero-width and direction-changing Unicode characters, so a human reviewer sees nothing while the model reads all of it.

Scanner numbers deserve care, and so does panic. A study of 238,180 skills found that marketplace scanners flagged up to 46.8% as malicious, yet only 0.52% stayed suspicious once each skill was read against the GitHub project around it. Most free skills are harmless. The trouble is that you cannot tell which ones from the name, the description or the download count.

The trap that worked on our own agent

We measured how this goes wrong for an agent that can spend money. Our test gave a Claude agent a wallet and 98 traps, tucked into the pages, files and messages its tasks sent it to, and our full report on which injections got it to pay has the details. The loud kinds, text addressed to the AI, claimed authority, hidden characters, base64, moved no money at all. What did work was a charge dressed as an ordinary step of the task: a licence fee among the numbered steps of a setup guide, one extra entry slipped into a shopping list that came from the user. Without a guard, Sonnet made a payment attempt in 10 of its 294 trap runs, and Haiku in 29.

Now picture a skill. A skill consists of nothing but steps that look like part of the work. An attacker never needs to write "ignore your instructions"; a numbered step that says to install a helper first, or to post a usage report to some address, reads exactly like every other line in it. That is how the ClawHavoc "Prerequisites" section worked.

There is good news in another of our tests. When a model is asked to review a SKILL.md as text instead of following it, it does notice the plain hidden orders. With no special instructions, both Sonnet and Haiku flagged every planted line we tried: a request to read an SSH key, an order to copy files quietly to a shared drive, a claim to override the system's instructions, a note asking the reviewer to report nothing, a pasted API key and a download piped straight into a shell. Each was a single run per model. Reading a file and obeying it are different jobs, and the reading is cheap.

How to check a skill before you install it

A blue robot checks a scroll with a magnifying glass while one scroll with a red hook lies apart in a red tray

Know where it came from. A skill you wrote, one from the vendor of your agent, or one from a publisher you can actually look up. Treat rank and download count as noise; both cases above show they can be bought or faked.
Read every file, not only SKILL.md. Scripts (.py, .sh, .js), other markdown files it points to, and anything it downloads at run time. Anthropic's review checklist rates bundled scripts as high risk because they run with full access to your environment.
Search for the patterns that carry an attack. Network calls (curl, wget, fetch, requests, http). "Install this first" steps and links to download pages. Reads of ~/.ssh, .env files, tokens such as gh auth token, wallets or browser data. Any line that tells the agent to conceal what it does, skip a confirmation or put other rules aside. Long encoded blobs. In Claude Code, any line that uses the ! syntax, since it runs as a shell command before the model reads anything.
Look for characters you cannot see. This prints every line that holds a zero-width, soft-hyphen or direction-changing character, with the character spelled out:
```
python3 -c "import sys,re;[print(n,repr(l)) for n,l in enumerate(open(sys.argv[1],encoding='utf-8'),1) if re.search('[-‏‪-‮⁠-⁤⁦-⁩]',l)]" SKILL.md
```
Run it on every text file in the folder. No output means none of those characters are there.
Ask a model to review it, not to use it. Paste the file and ask what it would make an agent do that the description does not mention. As above, both of the models we tried caught the plain hidden orders this way.
Run it first with no tools. Give the agent the skill's text and a sample task in a session where it cannot act: in Claude Code, claude --tools "" starts one with every tool switched off. Read what it tries to do. For anything that needs real tools, use a machine or account that holds no saved credentials.
Pin the version and read every update. Anthropic's checklist asks you to treat each update as a new deployment that gets a full review. The postmark-mcp case is why: fifteen clean versions earned trust, and the sixteenth spent it.

A check that can fail. Before you trust your own search, plant a line you know is bad in a copy of the skill, for example a zero-width space inside a word, or a step that sends ~/.ssh/id_rsa to a URL, and run the same checks on the copy. If they stay silent on the planted copy, their silence on the real file tells you nothing. We ran the command in step 4 on a file with one hidden character, where it printed that line, and on a clean file and a Cyrillic one, where it printed nothing.

Why we write and test every skill ourselves

That checklist is the work an agent should not have to repeat for every file it buys, and it is the reason our store at aiskills402.com exists. What stands behind each skill there:

We write every skill ourselves. We read other people's skills for ideas, but we never resell their files.
Every file passes an automatic check before it goes on sale. It refuses code blocks, shell commands, links to outside addresses (apart from a few that a skill's subject needs, each approved by hand), instructions that send data away, encoded blobs, raw HTML, hidden characters, and any line written to steer the model. What you get is plain text that you can read from top to bottom.
Every skill is tested on a strong and a weak Claude model, and its page shows the results, including where the weaker model fails.
When we study someone else's skill, it runs with every tool switched off and with our guard in the system prompt, so whatever it hides stays text.

If you still use a free skill

Plenty of good skills are free, and you will install some. For that case, the one skill of ours this post recommends is the prompt injection guard: a short block that stays in your agent's system prompt, plus a longer file the agent can open when it needs more. In our trap test it took Sonnet from 10 payment attempts in 294 trap runs to none, and Haiku from 29 to 5. With real USDC on Base, Sonnet went from 3 of 98 to 0 and Haiku from 9 of 98 to 1, while ordinary tasks and purchases the user did order kept working.

It narrows the risk and does not remove it: Haiku still fell for one trap where a list entry named one product and its address pointed at another. And because it lives in the prompt, it cannot stop a script or a ! command that runs before the model reads anything. Those are what steps 2 to 7 are for.

When this does not apply

Skills you wrote, or ones your team reviews like code. The checklist is for files from strangers. A skill from a colleague still deserves the update rule in step 7.
An agent that can only answer in text. With no tools, no secrets and no network, the worst a bad skill can do is a bad answer, which you still have to read with care.
Our numbers are our own cases. We wrote the traps and the planted lines ourselves, tested two Claude models from Claude Code, ran each review case once per model, and measured payments and one planted secret, not deleted files or commands run on a machine. Real attackers write differently.
The registry counts belong to their authors. Each comes from a different scan, date and method, and registries remove what gets reported, so the numbers today are not the numbers of February.
A guard in the prompt is not a sandbox, and a search for known patterns will miss a pattern nobody has listed yet. The checks above make an attack harder to hide; they do not make an unvetted skill safe.