Installing an agent skill is running untrusted code

A skill file looks like documentation. It is mostly prose, it explains what it does, and it drops into your agent with a click. So teams install one the way they read a README: skim it, trust it, move on. That instinct is the exact gap the current wave of attacks is built to walk through.

An agent skill is not a document. It is instructions plus scripts your agent runs with your permissions. Anthropic's own description is direct: "Skills can also include code for Claude to execute as tools at its discretion." The moment a skill can run code, installing it stops being an act of reading and becomes an act of executing. The right mental model is not "should I trust this doc" but "should I run this program."

#How bad is the marketplace, really?

Bad enough that the first comprehensive audit is uncomfortable reading. In February 2026, Snyk scanned 3,984 skills across the ClawHub and skills.sh marketplaces. The result: 36.82% of them, 1,467 skills, carry at least one security flaw, and 13.4%, 534 skills, contain a critical-level issue. Among the skills they confirmed as outright malicious, 91% combine prompt injection with traditional malicious code. And 17.7% of skills fetch untrusted third-party content, which turns even a well-meaning skill into an indirect injection path.

Those marketplaces are third-party ecosystems, not an official Anthropic store. That distinction matters, because it is exactly where the "just a markdown file" assumption does the most damage: no mandatory security review sits between the author and your agent.

#The attack hides in the documentation itself

The naive worry is a skill with an obvious malicious instruction. Modern defenses catch that. The 2026 research paper "Supply-Chain Poisoning Attacks Against LLM Coding Agent Skill Ecosystems" (arXiv:2604.03081) demonstrates the harder version. Its attack, Document-Driven Implicit Payload Execution, embeds malicious logic inside the code examples and configuration templates in a skill's documentation. Because agents reuse those examples during normal work, the payload runs without any explicit prompt telling it to.

The numbers show why this matters. Across four frameworks and five models, the document-driven attack achieved 11.6% to 33.5% bypass rates. Explicit-instruction attacks, over the same defenses, scored 0%. In other words: the defenses that stop an obvious injection do not see the one hidden in the example you were always going to run.

This is the point people miss. "It is just a markdown file" is not a reason it is safe. It is the reason the attack works.

#A skill is a supply-chain surface

Every discipline software teams already apply to npm and PyPI dependencies applies here, and for the same reason: you are pulling an artifact authored by someone else into a context with real privileges. Snyk frames agent skills as exactly that, a software supply chain that needs the same rigor. The MCP world has already learned this lesson the hard way through tool poisoning and rug-pull attacks, where a tool's behavior changes after you approved it. Skills inherit the whole surface.

Anthropic's guidance points the same direction. "We recommend installing skills only from trusted sources. When installing a skill from a less-trusted source, thoroughly audit it before use." Reading the bundled files, watching for code dependencies, and paying attention to anything that reaches an external network is not paranoia. It is the minimum.

#What a pre-install gate actually checks

The fix is not fear, it is a gate you run every time, the same way you would review a dependency bump. Before a skill or MCP server touches your agent, a person who is not the agent that wants it should confirm a short list: who authored it and at what pinned version, what it can actually touch, whether its own documentation carries hidden instructions, whether it reaches an external endpoint, and whether it puts private data, untrusted content, and outbound communication in the same place at once. Then pin it, dry-run it, sign off, and log the decision.

We published that as a copy-ready checklist you can paste into your install runbook: the Untrusted-Skill Gate, ten fail-closed rows, each tied to a documented attack.

The commodity layer keeps moving, and skills are how capability now spreads between teams. That is good. It also means the install step is now a place attackers aim at directly. The teams that stay safe will not be the ones who trust less. They will be the ones who read before they run.