# Thousands of Agent Skills Are Malicious. Here's How to Shop Safely.

*Noden blog · 2026-10-10 · https://getnoden.com/blog/malicious-agent-skills-how-to-stay-safe*

Agent "skills" are packages of instructions and code that teach an agent to do something new. They are easy to write and easy to share, and marketplaces for them grew fast this year. Attackers noticed.

## What the audits found

- **Koi Security** audited the ClawHub marketplace in February and found 341 malicious skills among 2,857. As the marketplace grew past 10,700 listings, that count rose to 824.
- **Snyk** examined 3,984 skills and confirmed 76 malicious payloads. It found that 13.4% of the skills had at least one critical security issue.
- **ESET** analyzed roughly 900,000 skills for its first-half 2026 threat report. It flagged about 25,000 as suspicious and more than 3,000 as directly malicious.
- **The Cloud Security Alliance** reported in July that skills can be built to slip past marketplace scanners, so a "scanned" badge gives less assurance than it appears to.

## A fair caveat

The picture is not uniformly grim. A March academic study of 238,180 skills argued that scanners over-flag. When the researchers added context from each skill's source repository, the share still looking non-benign fell to 0.52%. The honest summary: **most skills are fine, a small share is dangerous, and badges cannot reliably tell you which.**

## Why skills are risky by design

A skill you install runs with your agent's own access: its files, its shell, its saved credentials. Snyk found that 91% of the confirmed malicious skills combined bad code with prompt injection, text that talks the agent into misusing that access.

## A safer pattern: call, don't install

There are two ways to give an agent a new ability.

**Install it.** The code and instructions move into your environment and inherit its access.

**Call it.** The capability runs on the seller's side. Your agent sends an input and receives an output. Nothing foreign runs on your machine.

Calling is not risk-free. The returned text could still contain instructions, so it should be treated as data and checked against a schema. But the attack surface is far smaller.

## A checklist

1. **Keep an allowlist.** Let agents use only reviewed capabilities.
2. **Prefer remote calls** to local installs for anything from a stranger.
3. **Validate outputs** against a schema before the agent acts on them.
4. **Cap spending and access** at the infrastructure level, not in the prompt.
5. **Know what is already running.** ESET's advice starts with an inventory.

Noden's capabilities are called, not installed, and you are only charged when the output passes its check. [See the marketplace](https://shop.getnoden.com).

## Sources

- [SkillCloak: Malicious Agent Skills Evade Marketplace Scanners, Cloud Security Alliance](https://labs.cloudsecurityalliance.org/research/csa-research-note-skillcloak-agent-skill-evasion-20260706-cs/)
- [Exploring the Threat Landscape of Agent Skills, Snyk](https://research.snyk.io/blog/agent-skills-threat-landscape/)
- [1 in 300 AI Agent Skills Is Directly Malicious, Expert Insights on ESET's report](https://expertinsights.com/news/1-in-300-ai-agent-skills-is-directly-malicious-eset-research-finds)
- [Malicious Or Not: Adding Repository Context to Agent Skill Classification, arXiv](https://arxiv.org/abs/2603.16572)
- [Poisoned Skills: AI Agent Marketplace Supply Chain Attacks, Cloud Security Alliance](https://labs.cloudsecurityalliance.org/research/csa-research-note-ai-skill-supply-chain-attacks-20260624-csa/)