Why you should not install unvetted AI agent skills

Summary

Unvetted agent skills expose two distinct execution paths: instructions that persuade an agent to misuse its authorized tools, and bundled or dynamically executed code that can act without the model's approval. The underlying prompt-injection risk becomes especially consequential when an agent can access private data, encounter attacker-controlled content, and communicate externally. Installing a skill intentionally introduces instructions into that privileged workflow.^[0][2]

The article grounds its warning in several reported skill-registry incidents rather than a single vulnerability. It attributes to Koi an audit finding 341 malicious ClawHub skills among 2,857 examined, with 335 associated with ClawHavoc. The reported lure asked users to install a prerequisite; the macOS payload matched the Atomic Stealer family. Other cited cases involved a highly downloaded skill pointing to an infostealer and a top-ranked skill instructing silent data transmission. These examples undermine download count and marketplace rank as sufficient trust signals.^[0]

The publisher's own experiments suggest that malicious steps can be effective when they resemble legitimate task requirements, such as a setup charge or an added shopping-list entry. Its separate skill-review tests found that both tested Claude models recognized the planted malicious instructions when asked to inspect rather than obey them. These results are limited: each review example was tested once per model, the publisher authored the traps, and the experiments did not establish protection against arbitrary shell execution or destructive filesystem activity.^[0]

The defensive priority is to review the complete skill package before granting it operational access, including scripts, referenced files, runtime downloads, and dynamic-context commands. Tool-disabled text rehearsal and credential-free test environments reduce exposure during evaluation; version pinning and renewed review address later changes. Prompt guards and pattern searches are supplementary controls, not proof of safety. Most registry and vendor findings in this evidence set are relayed by the focal article rather than independently supplied reports, and the article also promotes its own commercial skills and guard.^[0]

How it works

Instruction-source confusion is the principal model-mediated mechanism. A skill is loaded specifically to direct an agent's work, so an attacker can place an unauthorized action alongside legitimate workflow steps. The model may treat that action as part of the user's task rather than as hostile third-party content. The separately supplied analysis explains why this is difficult to eliminate with prompting alone: instructions from different origins ultimately enter the model's token context, and source-based distinctions are not reliably maintained.^[0][2]

Prerequisite and dependency lures exploit this workflow ambiguity. In the article's account of ClawHavoc, a Prerequisites section induced installation before the advertised task could proceed; the reported macOS payload belonged to the Atomic Stealer family. The article describes a similar required-dependency pretext in a highly downloaded Twitter skill. These are installation and social-engineering paths carried by skill instructions, not evidence of a memory-corruption exploit.^[0]

Claude Code dynamic context creates a separate, pre-model execution boundary. The article reports that shell commands embedded with ! syntax run before the rendered skill reaches the model. A model that subsequently recognizes credential theft and refuses the task therefore cannot prevent an earlier command from executing. Bundled scripts likewise require code review rather than reliance solely on the model's interpretation of the skill description.^[0]

Concealment can operate at both the presentation and workflow levels. The article describes zero-width and direction-changing Unicode instructions in coding-agent rules files that are difficult for a human reader to see. It also reports that ordinary-looking task additions succeeded in its payment experiments where louder authority claims and several obfuscation techniques did not move money. The latter is a bounded experimental finding, not evidence that overt injection techniques are generally ineffective.^[0]

Data theft requires an operational path beyond merely producing misleading text. The supplied background essay identifies the combination of private-data access, exposure to untrusted content, and external communication as the critical configuration. The focal article applies that concern to skills that request credential reads, outbound transfers, or concealed network activity, and distinguishes those risks from agents limited to text output without tools, secrets, or networking.^[0][2]

Key takeaways

• A skill can be both an instruction supply-chain input and a code-execution package. Model-side scrutiny addresses only part of that surface.^[0]
• Task-shaped malicious instructions deserve attention: an apparently necessary installation, fee, or reporting step can carry the unauthorized action without an obvious instruction to ignore safeguards.^[0]
• Private data, untrusted content, and external communication form the central risk combination for agent-driven exfiltration. A skill's trustworthiness must be evaluated in the context of the capabilities the receiving agent actually has.^[0][2]
• Successful text review, clean scanner output, marketplace popularity, and previously clean releases are not durable safety guarantees. The evidence supports layered review and constrained testing, followed by renewed review when the package changes.^[0]
• The available evidence supports practical defensive guidance, not a universal malicious-skill prevalence estimate or proof that the publisher's guard generalizes beyond its tests. Registry statistics and experimental outcomes should retain their original scope and limitations.^[0]

Defensive actions

• Establish the skill's provenance before installation; do not use download count or marketplace rank as the approval criterion.: The article recommends skills written internally, supplied by the agent vendor, or obtained from an identifiable publisher. Its reported highly downloaded and top-ranked malicious examples show why popularity alone does not establish trust.^[0]
• Review the complete package, not only SKILL.md, including bundled scripts, referenced documents, and anything fetched at runtime.: The article identifies scripts and runtime downloads as additional execution surfaces and relays Anthropic's warning that bundled scripts can run with full environmental access. Reviewing only the advertised instructions leaves those paths unexamined.^[0]
• Inspect Claude Code skills for ! dynamic-context commands and disable this shell-execution capability through managed settings where appropriate.: The article attributes to Datadog both the pre-model execution behavior and the availability of an organizational control to switch it off. A prompt-level refusal is too late to control a command that has already run.^[0]
• Search for outbound network operations, credential access, prerequisite installers, encoded content, and instructions to conceal activity or bypass confirmation.: The article specifically highlights curl, wget, fetch, requests, reads of SSH material and environment files, token retrieval, wallet or browser access, and language that suppresses disclosure or overrides other rules. These patterns match the installation, exfiltration, and concealment mechanisms described in its examples.^[0]
• Inspect every text file for zero-width, soft-hyphen, and direction-changing characters; validate the inspection against a deliberately seeded copy.: The article describes invisible Unicode instructions and recommends testing detection with known planted content. A check that misses the seeded example cannot justify confidence when it reports no findings on the real skill.^[0]
• Ask a model to review the skill as inert text and identify actions not disclosed by its description, rather than asking it to use the skill.: Both models in the publisher's limited review experiment detected all planted examples under that framing. Because each example received one run per model, this is an additional review aid rather than a reliable safety certification.^[0]
• Rehearse the skill's text and a sample task with tools disabled before allowing operational execution.: The article gives claude --tools "" as a Claude Code option for a tool-disabled session and recommends observing what the agent proposes to do. This evaluates intended behavior without granting the agent tool access; it does not replace separate inspection of scripts and pre-model execution features.^[0]
• When real tools are necessary for evaluation, use a machine or account without saved credentials.: The article explicitly recommends this testing arrangement. It limits exposure of the secrets targeted by the credential-reading and exfiltration behaviors discussed in the evidence.^[0]
• Pin the reviewed version and treat every update as a new deployment requiring full review.: The article's postmark-mcp example reportedly remained clean for 15 versions before version 1.0.16 added copying of outgoing messages. Prior benign behavior therefore does not validate a later release.^[0]
• Use prompt guards only as a supplementary layer, not as a substitute for execution controls or package review.: The publisher reports reduced payment failures with its guard but a remaining Haiku failure. It also explicitly states that a prompt guard cannot stop a script or dynamic-context command that executes before the model reads the skill.^[0]
• Interpret scanner findings in context and distinguish critical issues, suspicious content, and confirmed malicious payloads.: The article reports different measures across different studies and cautions that dates, methods, and removals change registry counts. Its cited contextual study found a large gap between initial scanner flags and content remaining suspicious after project-level review, so raw flags should not be presented as confirmed malware prevalence.^[0]