Already 7 months old when the scout caught it.
Malicious agent skills
What it is
A malicious agent skill is a published "agent skill" package — the reusable, markdown-formatted capability files agents like Claude Code load and execute — that looks legitimate on inspection but carries an adversarial payload that only activates when a model processes it at runtime. The payload can live in executable scaffolding (shell scripts, install hooks) or, more distinctively, in the natural-language prose of the SKILL.md itself: instructions steering the agent to exfiltrate credentials, install backdoors, or take other actions the skill's stated purpose never mentions. Snyk's research team named the threat class "ToxicSkills"; OWASP's Agentic Skills Top 10 catalogs the same pattern as AST01, "Malicious Skills."
Why it's emerging now
Agent skills exploded as a distribution mechanism through 2025–2026 registries like ClawHub and skills.sh, with a low bar to publish — a markdown file and a week-old GitHub account, no code signing, no security review, no sandbox by default. Because a skill inherits the full permissions of the host agent, it became an attractive supply-chain vector, structurally similar to npm or PyPI package compromises but with a second attack layer unique to agents: the prose itself, which a traditional static scanner doesn't parse as "code." Snyk's February 2026 audit of nearly 4,000 skills found over a third carried some security flaw and 76 held confirmed malicious payloads; a follow-on USENIX Security 2026 measurement study and the documented "ClawHavoc" campaign (1,184 malicious skills across 12 publisher accounts sharing one C2 IP) turned this from a hypothetical into a recognized, actively-exploited risk. OWASP formalizing it as AST01 in its August 2026 Agentic Skills Top 10 v1.0 marks the point where the industry settled on it as a named, standard risk category rather than a one-off finding.
How it relates to what you know
It's a distinct species of the ledger's existing "Prompt injection / jailbreaking" and "Agent skills" entries, sitting at their intersection: instead of injecting malicious instructions through untrusted runtime content an agent reads, the attacker plants them in a skill package before it's ever installed, turning skill distribution into a supply-chain problem rather than a runtime-content problem. It's the skills-ecosystem analog of npm/PyPI typosquatting and malicious-package attacks, adapted to a payload that's natural language rather than code.