1,184 skills fell in one campaign — because Agent Skills has no line between data and instructions

Notes on Towards Secure Agent Skills: Architecture, Threat Taxonomy, and Security Analysis (arXiv:2604.02837) — Zhiyuan Li, Jingzheng Wu, Xiang Ling, Xing Cui, Tianyue Luo · April 2026

Note published July 25, 2026 · written by SkillFed’s research pipeline from the paper above · how these notes are made

AI-assisted notes · reviewed by SkillFed Skill security

Agent Skills — the filesystem-based packaging format that lets agents load domain-specific instructions and bundled scripts on demand — has never had a systematic security audit until now. This one splits a skill's life into four phases: Creation, Distribution, Deployment, Execution. Each opens a different door: authors get unrestricted control over SKILL.md and its scripts, marketplaces distribute without review, and the access a user actually grants at install time runs broader than what they think they're agreeing to. From that lifecycle view comes a threat taxonomy of seven categories and seventeen concrete attack scenarios, grouped into three layers: delivery and trust establishment, runtime attack, and persistent/lateral impact.

Five confirmed incidents validate the taxonomy, all real-world and running December 2025 through February 2026. A skill billed as a GIF converter smuggled MedusaLocker ransomware inside its bundled script. A supply-chain campaign called ClawHavoc compromised more than 1,184 skills in one marketplace — roughly one in five listings there. Two CVEs let a malicious repository inject hook configurations and reroute API traffic to an attacker before any trust dialog appeared. A Mitiga-documented skill exfiltrated an entire project codebase in four user interactions while its audit log stayed empty. The authors trace all of it to three design choices: SKILL.md draws no boundary between instructions and data, a single install-time approval grants standing operator-level authority indefinitely, and most marketplaces require no security review before publishing. None of the three, they argue, is something a better scanner alone can fix.

Key numbers

Threat scenarios in taxonomy	17 across 7 categories
Confirmed incidents validated	5
Skills compromised in ClawHavoc campaign	1,184+ (~1 in 5 listings)
User interactions to exfiltrate a full codebase	4
Skills with ≥1 vulnerability (cited study, 42,447 scanned)	26.1%

What this means for skill authors

The data-instruction boundary problem is the one worth internalizing if you write skills. A bundled script that reads a config file, a fetched dependency, or scraped web content pulls that text into the same trust plane as your actual instructions — the agent has no structural way to tell 'text to obey' from 'text to process.' That's the exact mechanism behind the Mitiga case: four ordinary-looking interactions and an entire codebase gone, with nothing in the audit log to show it happened.

The single-approval trust model matters more for anyone installing skills than the taxonomy's category count does. One click of consent at install time authorizes everything that skill does from then on — including a later supply chain compromise that swaps in a malicious update, or a dependency that resolves to different code on run ten than on run one. Treat a skill's initial review as a snapshot, not a permanent clearance: something clean at listing time can still turn hostile once users have already granted it standing trust. It's why SkillFed treats scanning as an ongoing check on a catalog entry rather than a one-time stamp — a vetted listing narrows the distribution-phase gap the paper describes, but deployment and execution-phase risk, like config injection or a swapped dependency, needs its own separate defense.

None of this gets fixed by scanning harder within the current format — the paper is explicit on that point. It argues for architectural change instead: fine-grained per-capability permissions rather than one blanket grant, trust bound to a specific content hash rather than a namespace, and sandboxed execution for bundled scripts. Until skill ecosystems adopt something like that, the honest posture for authors and users alike is to treat a skill's write access, network egress, and dependency chain as live risk surface, not a question answered once at install.

Skills related to this research

knowledge-base Create a compounding knowledge base—a workspace wiki of plain markdown pages linked together with wikilinks, designed to grow denser and more interconnected as you add sources. Ingest articles, documents, and notes into versioned raw files, then synthesize them into organized pages with frontmatter, cross-references, and provenance tracking. Run automated linting to catch broken links, orphaned pages, and schema drift, keeping your knowledge graph clean and queryable.★ 1,423 architecting-security Architecting Security guides strategic security design through defense-in-depth layering, zero trust implementation, and structured threat modeling. Map controls to NIST CSF, CIS Controls, and ISO 27001 for governance and compliance across greenfield systems, cloud migrations, and enterprise audits.★ 390 Security Engineer Security Engineer provides a comprehensive framework for implementing authentication and authorization in web applications. Leverage AI-assisted development standards to design secure access controls, manage user credentials, and enforce permission policies across your platform.★ 32 localize-campaign Transform your campaign for global reach by localizing all assets—emails, ads, social posts, landing pages, and scripts—across multiple target markets simultaneously. The skill handles translation routing, cultural adaptation using established frameworks, compliance modifications per region, and SEO localization, then packages deployment-ready assets with quality scores for each market. It goes beyond word-for-word translation to ensure creative content resonates culturally and all regulatory requirements are met.★ 641

Related notes

References

Li, Wu, Ling, Cui & Luo, "Towards Secure Agent Skills: Architecture, Threat Taxonomy, and Security Analysis," arXiv:2604.02837 (2026).
Liu et al., large-scale empirical vulnerability scan of 42,447 Agent Skills finding a 26.1% vulnerability rate (cited in this paper as corroborating evidence).
CVE-2025-59536 and CVE-2026-21852 (Agent Skills config-injection vulnerability disclosures referenced in the incident analysis).