Top agent skill security resources — November 2026

OpenAI’s official render-deploy skill told agents that private Render services live under a domain that was neither Render’s nor registered. Codex wrote that domain into generated code, and once it was registered as a sinkhole, production apps sent it tokens.

Scanners and session boundaries fared no better. In testing, a skill pairing benign Python source with a substituted bytecode cache got past seven skill scanners at 94-100% attack success, and artifacts left behind by one skill carried attacks into later sessions on Codex CLI, Gemini CLI, and Claude Code at rates of up to 77.4%.

The thread through October’s research was composition. Skills that each pass vetting can still chain into violations, and one graph analysis found 612 insecure compositions among 13,598 clean ClawHub skills.

Seventeen resources follow, grouped by topic. This is the first edition of the series. For background, see our test of eight open source skill scanners and the OWASP Agentic Skills Top 10; the agentic AI security hub collects the rest.

Statistics

Total resources: 17

Agent skill security resources

Attack technique

PyCache trap: the inspection-execution gap in agent skill scanners

Skill scanners read documentation and visible source, but Python may execute a bundled bytecode cache that behaves differently. Pairing benign source with a substituted cache reached 94-100% attack success across 100 skills and seven scanners, and none of the scanners recognized what the cache actually did. The proposed execution aware validation, which includes trusted reproduction of compiled artifacts, detected all 100 evaluated substitutions and reached 92.8% recall at a 10% false positive rate across five attack families, so admission checks need to cover what the runtime can load as well as what a reviewer can read.

Encrypted skills can become new security exploits if AI agents know how to decipher

Instructions hidden in a skill file with Caesar and layered encodings get decoded and followed by the agent, with attack success of up to 47.5% and 40.3% respectively across eight models in a primary setting using shortened skills. Decoding did not guarantee a successful attack and layering had model dependent effects, but the tested skill scanners rarely flagged the injected skills. The risk to control is an agent promoting decoded, untrusted content into instructions it acts on.

Poisoned skills: propagating jailbreaks through agent Markdown files

A jailbreak embedded in a Markdown skill file lifted mean attack success from 0.5% to 45% across seven open weight models, and as high as 68.9% for individual models, in a LangChain question answering agent built for the test. Zero width and phonetic obfuscation did not beat plain text, and the phonetic variant dropped mean attack success to 30%. As with the ciphered injections above, results turned on the model, and this study found it mattered more than the obfuscation, so test the models you actually run with skill files loaded.

MetaCascade: end-to-end attacks on agent skills via metadata-only poisoning

Skill retrieval and final selection both draw on what a skill says about itself, so poisoning metadata alone can influence the whole chain. Candidates generated by semantic expansion and tuned with black box competition feedback beat the strongest baselines by 35.53 percentage points of average attack success, and by 34.65 points under four defense settings, in tests on Hermes and OpenClaw. Treat a skill’s metadata as attack surface in vetting, since selection depends on it.

Surviving the router: optimizing skill injections for retrieval and execution

Skill injection evaluations often assume the malicious skill has already been selected, but in multi skill settings it first has to win retrieval, which cuts the effective attack success of existing injections by 87-97%. That margin does not hold against an attacker who optimizes for the router: CORSA targets both retrieval and execution across clusters of related tasks, substantially improves end to end success while preserving user utility, and transfers across router architectures and LLM backbones. Together with MetaCascade above, it marks skill selection as a target in its own right.

CoSA: the conflict of skills attack in real-world LLM agent ecosystems

Adding locally admitted skills, capped at 5% of each pool and leaving existing skills and runtime permissions unchanged, raised the policy violation rate from 35.02% to 58.45% across five LLMs and three agent harnesses. The benchmark’s 288 tasks span recruiting, finance, IT, and business work. A lightweight harness guard that checks information flow and authorization before consequential actions cut violations from 65.28% to 6.67% on OpenClaw recruiting tasks, while compliant task completion on benign controls moved only from 66.67% to 65.00%.

Runaway reaction: when benign skills compose into malicious behavior

Directly composing skills that each pass standalone vetting can already induce malicious behavior. Where direct composition falls short, the CRIME framework refines the selected skills with execution feedback in a sandbox while requiring each one to stay benign under standalone vetting. Its benchmark of 4,000 public skills across eight cybersecurity behaviors is a yardstick for vetting that only looks at single packages, and it reads well next to KnotScryer below, which hunts the same class of chain from the defensive side.

Understanding and mitigating cross-session attacks via persistent artifacts in agent skill composition

Files, configurations, and cached data written by one skill can steer a different skill in a later session, through instruction propagation, data boundary violation, or evidence poisoning. Across seven models on OpenAI’s Codex CLI, Google’s Gemini CLI, and Anthropic’s Claude Code, attack success ranged from 46.7% to 77.4% and full attack chain success from 35.6% to 61.1%. SkillRelayGuard, an advisory review that restores artifact provenance before execution, cut overall attack success from 69.5% to 10.9% while raising legitimate task completion from 79.6% to 87.5%, so persisted artifacts belong in your review scope.

Agent skill defense

Detecting insecure compositions of clean agent skills via capability-flow graph analysis

Treating skills as typed capability flows, KnotScryer builds a graph of cross skill handoffs and identified 612 insecure compositions among 13,598 clean ClawHub skills, validated across three agent frameworks and three LLMs. Under GLM-5.1 it raised the exploitation rate from 16.5-18.2% for baselines to 85.6%, and 13.7% of the detected chains consist entirely of skills a single skill scanner labeled safe. It is the defensive counterpart to the composition attacks above: the risk comes from the agent’s runtime orchestration, so auditing skills one at a time cannot capture it.

From instructions to exploits: applying program analysis to malicious agent skills across natural language and code

SCS compiles a skill’s natural language instructions into a constrained Python style intermediate representation and links it to bundled code in one dependence graph, so it can trace behavior that spans both. Averaged across five LLMs, it reached 95.2% recall and an F1 of 86.9% on a manually verified benchmark of 234 skills. On 66,157 ClawHub skills it yielded 2,473 candidates, of which 627 were confirmed malicious through dynamic validation and manual review, so about one candidate in four survived and triage needs its own budget.

MalSkills: detecting malicious skills in the agentic supply chain via neuro-symbolic reasoning

This neuro-symbolic scanner links operations across a skill’s heterogeneous artifacts into a dependency graph, reaching 93% F1 on 200 real skills. Across 150,108 skills from seven public registries it flagged 620, and manual review confirmed 400 as malicious. Like SCS above, it rests on connecting behavior across artifacts, but the two confirmed counts come from different methods and corpora, so don’t read them side by side as prevalence estimates.

Scan before you install: detecting and mitigating local and composite vulnerabilities in skills

Existing scanners mostly hunt malicious skills, while this six module scanner looks for unintended vulnerabilities in benign ones and for multi skill interactions, the problem KnotScryer also targets. Its local analysis reached 95.9% recall at a 4.22% false positive rate on a benchmark subset, and its F1 of 0.947 on a balanced sample of 1,000 skills beat scanners including Cisco’s Skill Scanner and NVIDIA’s SkillSpector. In 1,587 skills from the 75 most starred GitHub repositories, analysts confirmed 53 of 59 findings, and for 47 of 55 GitHub findings its suggested mitigations prevented proof of concept attacks in all trials while preserving tested legitimate functionality.

Article

Skill constellations: tracing the supply chain of agent skills on GitHub

Developers share skills by copying them between repositories, which makes them a supply chain with no registry, versions, or provenance. A dated copy network of 2,193,119 skill adoptions on GitHub shows that a few repositories source almost all copies, that GitHub stars do not identify them, and that a fix at the source rarely reaches the copies. Auditing the model’s top 100 repositories prevents 14.9% of later adoptions of high risk skills, against 0.5% for the 100 most starred, which argues for distributing versioned references rather than copies.

When skills tell agents not to ask: a large-scale study of oversight directives in agent skills

About one in seventeen of 1.53 million English skills, roughly 88,000, contains a directive that loosens oversight, such as proceeding without approval or bypassing checks with --no-verify, most often through permission flags, and 70.1% of these directives apply unconditionally. Skills that run shell code, install packages, or use sudo have 1.7-1.8 times the odds of carrying one, compared with skills that have the same amount of oversight language. As in the copy network study above, a small upstream set drives the spread, with 2.4% of carrying skill families accounting for half of all copies, and open source scanners catch at most 46% at a precision below 0.4, so search for these directives explicitly.

Agent skill vulnerability

OpenAI Sesame: skill vulnerability in OpenAI’s official skill made production apps leak tokens, real victims found in the wild

OpenAI’s official render-deploy skill told agents that private Render services live under render-internal.com, which was not Render’s domain, and in testing Codex wrote it into generated application code and deployment configuration as the default internal API address. Once the domain was registered as a passive sinkhole, real services sent it live calls carrying tokens, though the report gives no victim count. Render has removed the references, OpenAI has pulled the plugin from openai/plugins, and the domain is now under Render’s control, so update to the patched skill, treat every domain a skill references as a dependency, and check vendored copies too, given how rarely copies pick up source fixes in the copy network study above.

Threat modeling

Beyond maliciousness: static and runtime attack-surface profiling of agent skills

Profiling 6,309 listings from two marketplaces found evidence of shell execution capability in half, with network egress in 31%, credential access in 13%, and at least one elevated capability in seven of ten. The permission model is close to inert: pre-approving tools in frontmatter removes confirmation prompts rather than restricting reach, only 770 of the 6,061 listings whose frontmatter parses declare anything, and 59% of those understate what the bundle can do, with ClawHub understating on 88% of its declarations against 31% for skillsmp. Triage at the marketplace boundary has to rest on what the bundle can do, a profile that complements the maliciousness scanners above rather than replacing them.

Agent skill red teaming

SkillLifeBench: benchmarking security across the lifecycle of agent skills

A skill’s stored code, selected version, and loaded implementation can diverge across tasks and updates, and this benchmark of 388 paired scenarios ties those states to task outcomes across 14 models. On lifecycle tasks, challenged task success of 77.5% falls to 65.2% once avoiding the attack goal is also required; GPT-5.6-Sol and Sonnet 4.6 tied at 82.0% on runtime tasks yet reached 96.7% and 56.7% respectively on lifecycle tasks, so runtime scores alone won’t rank models for you. Adding execution provenance raised joint success from 49.35% to 65.58% in a matched recovery study, which lines up with the provenance defense in the cross session work above.

What to change in your skill intake this week

Vet your installed skills as a set. If one skill’s output can reach another’s input, map that path, because 13.7% of the insecure chains in the ClawHub analysis were built entirely from skills a scanner had cleared. Add a harness check on information flow and authorization before consequential actions, since that is the control that cut violations to 6.67% on the OpenClaw recruiting tasks.

Then tighten admission around what actually runs. Rebuild or reject bundled bytecode, ignore frontmatter declarations as evidence of what a bundle can do, and search skill text for encoded content and for --no-verify or instructions to proceed without approval. Extract every domain a skill references and confirm who owns it, official skills included.

Finally, replace copies with versioned references where you can, diff the copies you keep against their source, and choose audit targets by who gets copied from rather than by stars. Artifacts that skills persist across sessions need provenance attached before another skill reads them.

Part of our AI coding agent security coverage: the category, its attack surface, and the research behind it.