Malicious AI agent skills: what they hide and how to vet a Claude, Codex or Copilot skill before installing it

Skills are recommended on social media as shortcuts for getting more out of Claude, Codex, Copilot or Cursor, and they install by copying a folder or pasting a command. A skill is a set of instructions, and sometimes scripts, that an AI agent follows with the same permissions as its user. A malicious skill uses that access to steal data, install malware or divert the agent from its task.

In early February 2026, Koi Security reviewed 2,857 skills on ClawHub, the marketplace of the open-source agent OpenClaw, and found 341 malicious ones, according to The Hacker News. The firm Antiy later put the figure at 1,184.

The lesson is the familiar one about unverified software, and Anthropic's skills documentation recommends using skills only from trusted sources and treating them like installing software. What is new is that part of the harm can be written in plain language, without a single line of suspicious code.

What is a skill and why can it be dangerous?

A skill is a folder with a SKILL.md file that tells the agent how to carry out a task, and it can include scripts, templates and other resources. Anthropic created the format and released it as an open standard, now maintained by the Agent Skills project and adopted by tools such as OpenAI's Codex, Gemini CLI, GitHub Copilot and Cursor. A skill written for one agent usually works in the others, so a malicious skill can reach users of any of them.

At start-up, the agent loads the name and description of every installed skill. When a task matches that description, it reads the full text and, if it says so, runs the scripts in the folder. In Claude Code, according to Anthropic, skills have full network access, the same as any other program on the machine, and their commands go through permission prompts unless they have been approved beforehand. In claude.ai, network access depends on user and administrator settings, and through the API, skills run in a container with no network.

A skill can also arrive without being installed. Claude Code loads the skills a repository carries in its .claude/skills folder when working in it, and GitHub Copilot also reads those in .github/skills and .agents/skills, so opening a project downloaded from the internet with the agent amounts to accepting its skills.

That design explains the risk. Whoever writes the skill decides what the agent will do when it uses it, and the agent acts with the credentials, files and connections of the person operating it. Anthropic warns that a malicious skill can direct the agent to use tools or run code in ways that do not match its stated purpose, with a risk of data leaks or unauthorised access to systems.

Have any malicious skills been documented?

Several have, and the best-documented case is ClawHub, although later research shows the problem is still open and the same pattern appears in other agent components.

How was the OpenClaw marketplace infected?

ClawHub only required a GitHub account at least a week old to publish, which made room for a mass campaign that Koi Security named ClawHavoc. Of the 341 malicious skills Koi found, 335 included a "prerequisites" section with steps to install Atomic Stealer (AMOS), a credential-stealing program for macOS, through a command to paste into the terminal. On Windows, the lure was a password-protected ZIP file hosted on GitHub that contained a trojan able to log keystrokes.

Antiy counted at least 1,184 malicious skills published on ClawHub from 12 accounts, 677 of them from a single one, according to its ClawHavoc analysis. The names mimicked useful tools, such as cryptocurrency bots, YouTube utilities or Google Workspace integrations. The stealer took browser passwords, SSH keys, Telegram sessions and cryptocurrency wallets, and other samples opened a backdoor or sent out the file holding the AI service credentials the agent used.

Which figures did Snyk's study of almost 4,000 skills produce?

Snyk found security flaws in 1,467 (36.8%) of the 3,984 skills from ClawHub and skills.sh that it analysed in its ToxicSkills study, published on 5 February 2026, and confirmed 76 with malicious payloads. Of those 1,467 skills, 534 had a critical flaw. Of the malicious skills, 91% combined harmful code with manipulated instructions for the model, and eight were still available when the study was published.

The 1,467 are not malicious skills but skills with a flaw of any severity. Keeping the two figures apart avoids exaggerating the problem, although a vulnerable skill can be exploited too.

Are malicious skills still appearing?

They are still appearing, and some recent ones have got past the marketplace's filters. Unit 42, Palo Alto Networks' research unit, published an analysis of five skills on 23 June 2026 that had not been blocked by ClawHub's automated checks, which combine VirusTotal with ClawScan, the platform's scanner. One of them padded its README file to about 22 MB to exceed the size limits that many analysis systems apply.

Two of those skills did not steal credentials but used the agent to make money. One posed as a financial adviser and recommended products with affiliate links that its author could change remotely after installation. The other made the agents that installed it contribute funds to the operator's wallet, which bought a speculative cryptocurrency first at the lowest price and sold it into the artificial rally that the agents' coordinated activity created.

Does it only affect ClawHub?

The mass incidents documented so far are concentrated on ClawHub, but the same pattern has appeared in other components that extend what an agent can do. In September 2025, postmark-mcp appeared on npm, the JavaScript package registry, as the first known malicious MCP server. An MCP (Model Context Protocol) server is a connector that gives the agent tools to act on other systems, and this one, according to The Hacker News, added an outside address as a blind copy to every email it sent from version 1.0.16 onwards.

In February 2026, Check Point described several Claude Code flaws, since fixed and two of them with CVEs, through which opening an untrusted project could run commands or expose the API credential. Other cases from the same family have featured on this blog. They include Plugin4Shell's bypass of commit pinning in agent plugins, the npm worm that planted hooks in Claude Code and the backdoored Claude Code extension distributed through Cursor's marketplace.

What can a malicious skill hide?

Behind a useful appearance, a malicious skill can hide instructions for the agent, fake installation steps that download malware, harmful scripts or a change of behaviour that arrives later.

Manipulated instructions are the new element. The SKILL.md can ask the agent to read a credentials file or send data to an outside address, and the agent will do so if it has permission, because to the agent it is just another instruction. It is a form of prompt injection, an attack that slips commands into text a model reads, and the Cloud Security Alliance calls it agent context poisoning.

The researcher Johann Rehberger, of Embrace The Red, also showed that such directions can be hidden with invisible Unicode characters, which do not show on screen but which several models obeyed at the time. Rehberger observed in February 2026 that Claude Code was detecting and refusing them, without being sure it was a deliberate mitigation.

Fake prerequisites were the ClawHavoc trick. An installation section asks the reader to paste a command into the terminal or download a password-protected archive, the same social engineering technique as the fake-CAPTCHA ClickFix scam. Here the deception is not aimed at the model, because the person runs the malware.

Scripts in the folder can include obfuscated code that sends credentials and tokens off the machine or opens a remote connection, hidden inside a tool that works. An antivirus may catch some of that code, but not the text instructions that accompany it.

A later change is the hardest to spot. A skill can be harmless on installation day and change in an update, or download content from an outside address that its author alters at will. Anthropic warns that even a trusted skill can be compromised if its external dependencies change, and Unit 42's financial adviser case shows exactly that.

Why do scanners not catch every malicious skill?

Scanners do not catch every malicious skill because many of them, especially signature-based ones, look for known harmful code, and a skill can do damage with text that is not code. A plain-language instruction asking for a file to be sent to an outside address carries no malware signature. The Cloud Security Alliance cites research in which purely text-based techniques went undetected by the scanners evaluated.

Many analysis systems also have size limits, a weakness the 22 MB README documented by Unit 42 exploited. And the analysis happens at publication, so it does not cover whatever the skill downloads later. Review therefore cannot be left entirely to the marketplace or to the agent's vendor.

How should a skill be vetted before installation?

Vetting a skill follows the logic of third-party software and comes down to three questions, which are who wrote it, what it can do without asking and who it can talk to. Those questions apply before installation, during the first test and for as long as it stays installed.

What should be checked before installing it?

Before installing it, the checks cover its source, every one of its files and any dubious prerequisites.

1. The source must be identifiable. A skill developed in-house, published by the agent's vendor or taken from an approved internal catalogue inspires more confidence than a link shared on social media. Who publishes it, since when and with what track record should be checked first.
2. Every file deserves a read, starting with the full SKILL.md and not just its description. An instruction that does not fit the stated purpose, such as reading credentials, tokens or configuration files, sending data out or hiding something from the user, is reason enough to reject it.
3. The SKILL.md header matters too. In Claude Code, the allowed-tools field pre-approves tools, and hooks (commands that fire automatically on certain agent events) stay active for the rest of the session. Some commands also run when the skill loads without a permission prompt, if the user's rules or the skill's own allowed-tools allow them.
4. Prerequisites that ask for commands to be pasted into the terminal, for password-protected archives to be downloaded or for binaries of doubtful origin to be installed are a clear warning sign.
5. Scripts should be checked for network connections, reads of credential paths and obfuscated or Base64-encoded code, a way of disguising readable text.
6. A scanner for invisible Unicode characters can rule out hidden text that does not show when the file is read.

Open-source tools automate part of this review. Skill Scanner, published by Cisco AI Defense, combines pattern rules, analysis of Python code and, optionally, a language model to look for prompt injection, data leaks and malicious code. Agent Scan, from Snyk, finds the skills and MCP servers installed across more than a dozen agents and analyses them, although it requires a Snyk account.

Agent Scan sends the content it analyses to Snyk and can start the MCP servers it finds, so the project itself recommends running it in a container or virtual machine when the material is untrusted. Cisco warns that a clean result does not certify a skill as safe, and manual reading is still needed.

Where should the first test take place?

The first test should take place in an isolated environment, with no live credentials and limited network access, watching which files the skill reads and which connections it opens. Skills that download content from outside addresses call for extra caution at this stage, because their behaviour can change without the skill itself being updated.

And after installation?

After installation, the skill needs a pinned version and a fresh review of every update before it reaches staff machines, including changes the agent itself makes to its skills. Unused skills should be removed, because each one stays in the agent's context and widens what can be manipulated.

Where does each tool keep its skills?

Each tool keeps skills in user and project folders, and knowing them is the starting point for any inventory. Several also read each other's folders for compatibility, so the same skill can be active in more than one agent on the same machine.

A search for SKILL.md files in each user's home directory and in working repositories gives a first list of what is installed. In Codex, the /etc/codex/skills folder affects every user on the machine, and each skill can be disabled in the ~/.codex/config.toml file without being deleted.

Has a suspicious skill already been installed?

If a suspicious skill has already been installed, the first step is to remove it from every folder it sits in and find out what it did while active. The agent's session history and EDR (endpoint detection and response) telemetry show which commands it launched, which files it read and which destinations it connected to.

• If someone followed its prerequisites, pasting a command or downloading a file the skill pointed to, the machine should be treated as infected by a credential stealer and isolated from the network.
• Passwords saved in the browser, SSH keys, API and cloud tokens and open sessions are changed from another device, and cryptocurrency wallets are treated as exposed.
• The review should cover scheduled tasks, start-up items and outbound connections to unknown destinations, because malware usually leaves mechanisms to start again.
• If the skill could reach personal data about customers or staff, notification to the supervisory authority within the 72 hours set by the GDPR has to be assessed.

Where there are signs of credential theft or access to company systems, an incident response service helps establish the scope before the machine is declared clean.

How should a company manage them?

A company should treat skills, plugins and MCP servers as third-party software, with an inventory, prior approval, least privilege and monitoring. The first step is knowing what is installed, because many of these components arrive as shadow AI, without the security team's knowledge. The OWASP Top 10 for Agentic Applications, published in December 2025, lists this risk as ASI04, agentic supply chain vulnerabilities, and provides a common framework for auditing it.

Once that inventory exists, an internal catalogue of reviewed, version-pinned skills stops each employee from installing the latest social media recommendation. Agents should work with the bare minimum of privileges, in isolated environments when they run code and with no production credentials within reach. Endpoint activity logs, through the EDR or a similar tool, should record the commands agents launch, reads of credential paths and outbound connections to destinations the skill does not document.

The tools already include controls to apply these measures. In Claude Code, organisation-managed settings can restrict plugin marketplaces to an approved list (strictKnownMarketplaces) and block skills, hooks, agents and MCP servers that do not come from a plugin or managed settings (strictPluginOnlyCustomization). They can also stop skills from running commands when they load (disableSkillShellExecution) and switch off automatic plugin updates.

Anthropic also lets Claude Enterprise organisations scan the content of skills uploaded to claude.ai and Claude Cowork. That scanning does not cover skills uploaded through the API or the Console, and the documentation does not mention it for skills installed locally in Claude Code. The production controls for these components are set out in our guide to MCP and enterprise AI agent security.

In Spain, the data protection authority (AEPD) published a ten-point guide to delegating tasks to AI assistants and agents on 27 October 2026. Among other points, it recommends installing only add-ons and connectors of known origin, granting only the permissions needed without standing authorisations and, at work, using only the assistants the organisation has approved. An AI agent and MCP security audit can establish which components are installed and what they could do with the permissions they hold.

Is a malicious skill different from unverified software?

A malicious skill differs from unverified software in that the malicious code may not exist at all, because text instructions are enough. The action is also carried out by an agent working with the user's permissions. Checking the source, reading what gets installed, granting the minimum permissions and reviewing every update remain the defences that work.

That is why it makes sense to apply to skills now the discipline already imposed on browser extensions, npm packages and mobile apps.

Sources and attribution: this analysis is based on public information available on 2 November 2026, chiefly research by Koi Security (as reported by The Hacker News), Antiy, Snyk, Unit 42, Embrace The Red and Check Point, the Cloud Security Alliance research notes, the documentation from Anthropic, GitHub and the Agent Skills project, and the AEPD guide. Figures belong to each study and its date, and skill marketplaces change daily.

Note: the checklist is indicative and does not prove that a skill is harmless. Skills, plugins and MCP servers should be assessed against the permissions and data each agent can reach.