A new analysis of AI agent skills highlights a growing supply-chain risk: malicious instructions hidden inside ordinary text files can steal credentials, establish persistence, and survive system reinstalls.
The discussion began after a reported incident in which a user asked Claude for an audio transcription tool recommendation. The model returned a command that installed a malicious clone site. After the system was wiped and files restored from backup, the infection persisted because the payload lived inside a skill.md file that the owner continued to reload.
worklore.dev maintains a library of reusable agent instructions written in plain language. Because these files are executed by agents that run with the user’s full privileges, any unexamined skill is effectively untrusted code.
Scale of the problem
In February 2026 Snyk published ToxicSkills, an analysis of 3984 publicly available agent skills. The study found security issues in 36.8 percent of the skills and critical problems in 13.4 percent. Researchers confirmed 76 malicious payloads, eight of which remained available at publication time.
Documented attack patterns include environment-variable exfiltration via curl, base64-decoded eval commands that harvest AWS credentials, and remote instruction fetching that bypasses initial review. A real-world example is CVE-2025-6514 in the mcp-remote package, which carried a CVSS score of 9.6 and had more than 437 000 installations.
Why security badges fail
Traditional “verified safe” badges are considered unreliable for several reasons:
- Plain text can contain executable instructions such as “read ~/.ssh/id_rsa”.
- Skills can contain prompts that instruct reviewers to ignore previous rules.
- Payloads can be fetched at runtime, making static review meaningless.
- Any badge not bound to a content hash can be swapped after approval.
The proposed alternative is capability disclosure rather than safety certification. A five-tier system describes what a skill is technically able to do:
- T0 — Inert text only.
- T1 — Local predefined scripts and file writes, no network.
- T2 — Outbound network requests to listed endpoints.
- T3 — Persistence, secret access, privilege escalation, or destructive actions.
- T4 — Runtime code loading or decoding that cannot be statically verified.
skill-xray tool
The author released skill-xray under the MIT license. The scanner performs static analysis with regular expressions to extract hashes, network endpoints, and structural indicators, then passes results to an agent layer that produces human-readable reports. The tool deliberately avoids issuing “safe/unsafe” verdicts and instead reports concrete capabilities tied to a specific SHA-256 hash.
Because the system is designed for transparency rather than enforcement, users retain final responsibility for deciding whether a disclosed capability is acceptable for their environment.
