SKILL.md
YAML frontmatter plus Markdown instructions. Name and description are required; license, compatibility, metadata, and allowed-tools are optional.
Guide · Agent asset supply chain
Top 10 Risks for Agentic SKILLs
SKILLs are installable instructions, often with code attached, that run inside an agent. In practice, employees rarely install one SKILL in isolation. SKILLs arrive inside plugins, MCP servers, extensions, starter kits, and influencer-maintained repositories, often with little security review. This guide turns those risks into checks security teams can run against that full bundle.
This independent Optimus Labs guide is heavily inspired by the OWASP Agentic Skills Top 10 public-review draft. It describes the risks at a different level of detail, with more focus on bundled tools, control owners, and approval checks. It is not an official OWASP publication.
Reviewed against the OWASP Agentic Skills Top 10 public review v1 (OWASP Incubator Project, CC BY-SA 4.0) on September 18, 2026. The companion guide covers the Top 10 Risks for LLM Applications.
What is a SKILL?
SKILLs are small, sharp instructions you hand a coding agent so it works the way a senior engineer would. Install the ones you want, type a slash command, and the agent follows a process you actually trust.
An agent is only as good as the process you give it. Left to guess, it writes plausible code that quietly rots the codebase. A SKILL encodes one good habit, like grilling a plan, writing a spec, or reviewing a diff, so the agent runs it the same way every time.
SKILLs form a chain. Each one's output becomes the next one's input, so the whole workflow gets better as you tune single steps.
SKILLs are plain files, not a lock-in platform. They work in Claude Code, Cursor, Codex, Amp, Copilot, and any other AI agent or harness.
SKILLs do not operate alone, though. They ship inside plugins, MCP servers, extensions, starter kits, and repositories, and they can bundle scripts, hooks, and remote instructions. Their outputs feed other SKILLs. That is an AI supply chain: one compromised instruction or upstream source can influence every agent downstream. Optimus Labs discovers these relationships, assesses what each agent can access, and controls risky behavior at runtime.
Threat model · creation to consumption
How a SKILL travels from author to runtime
Review the installed bundle, not only the named SKILL. Every handoff can add code, instructions, identity, and external access.
Agent Skills specification
What is inside a SKILL directory
Required
scripts/
Executable code, including shell, Python, or JavaScript, that the agent may run.
references/
Documentation and supporting context loaded when the instructions reference it.
assets/
Templates, images, data, and other resources used to produce an output.
Discover: name + description
Activate: full SKILL.md
Use: supporting files on demand
The specification permits additional files and directories. Progressive disclosure reduces context use, but it also means security review cannot stop at the metadata initially visible to the agent.
01 · Authoring
SKILL and surrounding bundle
The Agent Skills directory is combined with any plugin, MCP server, extension, dependency, hook, or repository configuration shipped beside it.
02 · Distribution
Repository or registry
A marketplace, copied repository, extension, or influencer-maintained starter kit becomes the trusted source.
03 · Consumption
Enterprise endpoint
A user or workflow installs the bundle and approves its combined capabilities on a managed device.
Boundary 01 · Publisher to registry
Boundary 02 · Agent to enterprise
Boundary 03 · Enterprise to external
Tools and shell
Commands, files, browsers, APIs, and connectors become execution paths.
Sensitive data
Source code, cloud keys, tokens, memory, and business records are in reach.
External action
Network requests, messages, deployments, and uploads cross the final boundary.
Why SKILLs need their own list
A SKILL is rarely a lone markdown file. What people actually install is a bundle: SKILL.md alongside resources, assets, scripts, and prompt files, usually pulled down with npx as part of a productivity plugin from a personality or company they follow online.
The instruction file is often the smallest part of what lands on the endpoint, and the person who ran the command almost never sees the rest. The chain rarely stops at one bundle either: community repositories commonly add plugins, MCP servers, hooks, dependencies, and remote content, so one install can pull in many trust inputs. Security review must follow the bundle from publisher to registry, endpoint, agent runtime, and external action.
The ten risks
AST01
Severity: Critical
Control family: Signed provenance and behavioral review
Malicious Skills
Read the OWASP AST01 descriptionA SKILL can be malware from the day it is published. Antiy CERT linked 1,184 malicious SKILLs to the ClawHavoc campaign. Snyk later confirmed 76 malicious payloads in a sample of 3,984 SKILLs; 36.82% of those had at least one security flaw.
- Applies at
- Authoring, distribution, install
- Control owner
- AppSec and endpoint security
What to check
- Block approval when the publisher, repository, version, or installer cannot be attributed and retained.
- Inspect instructions and bundled executables, then retain the scan result and content hash.
- Alert on unknown publishers and observed runtime behavior, not only known malicious names.
AST02
Severity: Critical
Control family: Registry transparency and end-to-end provenance
Supply Chain Compromise
Read the OWASP AST02 descriptionThe SKILL may be clean at authoring while its repository, publisher account, registry entry, dependency, or update path is compromised later. Check Point showed that repository-controlled Claude Code configuration could execute commands and expose an API key before the trust dialog in CVE-2025-59536.
- Applies at
- Repository, registry, update path
- Control owner
- AppSec and platform engineering
What to check
- Resolve each installed SKILL to a specific publisher and repository, not a display name.
- Detect configuration and hook changes inside repositories that agents open.
- Block approval when source-to-install provenance or publisher identity cannot be verified.
AST03
Severity: High
Control family: Least-privilege capabilities and policy validation
Over-Privileged Skills
Read the OWASP AST03 descriptionA SKILL, plugin, or companion server can receive more file, shell, network, connector, or credential access than its task requires. Snyk documented more than 280 SKILLs exposing API keys or personal data through excessive access. A later compromise inherits those grants.
- Applies at
- Approval and runtime
- Control owner
- Platform engineering and IAM
What to check
- Compare each SKILL's declared capabilities against what its stated purpose actually requires.
- Audit auto-approve and skip-confirmation settings that SKILLs can rely on.
- Block approval when permissions cannot be scoped to the project, identity, and task.
AST04
Severity: High
Control family: Safe parsing, content review, and isolated loading
Insecure Metadata
Read the OWASP AST04 descriptionInstruction and manifest files such as SKILL.md, skill.json, manifest.json, and package.json are executable trust inputs. Unsafe parsers, deceptive metadata, hidden instructions, and brand impersonation can alter what an agent loads or what a user believes they approved.
- Applies at
- Authoring and load
- Control owner
- AppSec
What to check
- Read SKILL instruction files as code: diff them, review them, keep history.
- Look for instructions that reference credentials, environment variables, home directory paths, or outbound requests.
- Block approval when metadata suppresses confirmations, hides output, or cannot be parsed safely.
AST05
Severity: High
Control family: Source inventory, content pinning, and continuous review
Untrusted External Instructions
Read the OWASP AST05 descriptionSKILLs can pull live instructions from URLs, documentation, issue threads, or other sources outside the publisher's control. Air Security reported 17,822 SKILLs with at least one untrusted external instruction source in a scan of 142,836 SKILLs. Its proof-of-concept SKILL reached 26,000 agents after the scanners it tested cleared it.
- Applies at
- Load and runtime
- Control owner
- AppSec and SOC
What to check
- Inventory every external source each installed SKILL loads instructions or content from.
- Pin external content where possible and rescan it continuously, not just at install.
- Block combinations that expose one agent to untrusted input, sensitive data, and external action: the Lethal Trifecta.
Observed in the wild
A malicious SKILL crossing the trust chain
What Would Elon Do?Cisco reported nine flaws, including silent data-exfiltration behavior
polymarket-trading-botThe earliest malicious package in Antiy CERT's campaign timeline
reddit-trendsOne package tied to the coordinated ClawHavoc registry poisoning
base-agentA separate ClawHavoc package distributed through the same publisher network
polymarket-all-in-oneContained code capable of downloading a remote-control trojan
Each example links to the supporting Cisco AI Defense or Antiy CERT research. No executable instructions are reproduced.
Ecosystem shown: Cursor · OpenClaw · VS Code · Claude
AST06
Severity: High
Control family: Process, filesystem, credential, and network isolation
Weak Isolation
Read the OWASP AST06 descriptionA SKILL without process, filesystem, credential, and network boundaries can act with the host user's authority. Microsoft Defender recommends treating self-hosted agent runtimes such as OpenClaw as untrusted code execution with persistent credentials and running them in a dedicated isolated environment.
- Applies at
- Runtime
- Control owner
- Endpoint security and platform engineering
What to check
- Run agents and their SKILLs in isolated environments wherever the platform allows it.
- Implement network restrictions for agent processes, especially egress from machines with regulated data.
- Block deployment when isolation cannot be demonstrated with a runtime test and retained evidence.
AST07
Severity: Medium
Control family: Immutable pinning, change detection, and reapproval
Update Drift
Read the OWASP AST07 descriptionApproval applies to reviewed content, not a permanent SKILL name. Branch references, silent publisher changes, transitive dependencies, and bundled repository updates can make the installed artifact differ from the approved one.
- Applies at
- Update and continuous monitoring
- Control owner
- AppSec and platform engineering
What to check
- Pin SKILLs to versions or commits instead of tracking a branch.
- Detect content changes to installed SKILLs and re-review on change.
- Block changed content until the new hash, dependency set, and behavior are reviewed again.
AST08
Severity: Medium
Control family: Layered static, semantic, and behavioral review
Poor Scanning
Read the OWASP AST08 descriptionA clean scanner result is not an approval. SKILL risk may sit in natural-language instructions, remote content, bundled scripts, conditional behavior, or interactions between packages. Trail of Bits reported bypassing the public SKILL scanners it tested in under an hour.
- Applies at
- Install, update, and runtime
- Control owner
- AppSec and SOC
What to check
- Do not treat a scanner pass as approval; scan results are one signal, not a verdict.
- Prefer tools that combine static, semantic, and behavioral analysis over signature matching.
- Block approval when the review excludes instructions, dependencies, remote references, or runtime behavior.
AST09
Severity: Medium
Control family: Unified inventory, ownership, policy, and revocation
No Governance
Read the OWASP AST09 descriptionSecurity teams cannot govern packages they cannot find or assign. SKILLs often arrive through a larger plugin, extension, MCP server, or community repository, so a SKILL-only inventory misses the deployment unit, its owner, and the path needed to revoke it.
- Applies at
- Discovery through incident response
- Control owner
- Security operations and IT
What to check
- Build a live inventory of SKILLs, MCP servers, and extensions across endpoints.
- Assign an owner to every SKILL so findings and policies have someone to route to.
- Test that one policy action can quarantine or revoke a package across affected endpoints.
AST10
Severity: Medium
Control family: Portable identity, provenance, and policy metadata
Cross-Platform Reuse
Read the OWASP AST10 descriptionThe same capability can be copied between marketplaces, repositories, plugins, and agent products under different names and package formats. Each port can drop provenance, permissions, ownership, or prior findings, leaving separate teams to review the same underlying behavior again.
- Applies at
- Distribution and inventory
- Control owner
- AppSec and platform engineering
What to check
- Normalize your inventory across platforms so one SKILL is one entry regardless of packaging.
- Watch for the same publisher or payload appearing under different names on different registries.
- Block approval when a port cannot be linked to its source artifact and prior review record.
Approval gate for a SKILL bundle
Apply this gate to the whole installed bundle: SKILL, plugin, extension, MCP server, repository files, dependencies, and remote sources.
- Publisher and provenance. Pass when every artifact resolves to a verified source and retained version. Investigate identity gaps. Block unattributed or mutable sources.
- Instructions and metadata. Pass when reviewed content matches the stated job. Investigate hidden or remote instructions. Block attempts to suppress confirmation or output.
- Code and hooks. Pass when every bundled script, hook, and dependency is scanned and pinned. Block unreviewed install-time execution.
- Capabilities. Pass when tools, permissions, identities, and MCP servers are limited to the task. Block broad shell, data, or network access without a documented reason.
- Destinations. Pass known, required outbound routes. Investigate newly observed domains. Block undeclared egress.
- Persistence. Pass documented state changes. Investigate memory and project-file writes. Block hidden persistence.
- Combined risk. Review the complete installed set. Block any path that joins untrusted input, sensitive data, and external action without an enforceable boundary.
References
Official OWASP descriptions
- AST01: Malicious Skills
- AST02: Supply Chain Compromise
- AST03: Over-Privileged Skills
- AST04: Insecure Metadata
- AST05: Untrusted External Instructions
- AST06: Weak Isolation
- AST07: Update Drift
- AST08: Poor Scanning
- AST09: No Governance
- AST10: Cross-Platform Reuse
Examples and supporting research
- Antiy CERT: ClawHavoc
- Snyk: ToxicSkills
- Check Point: Claude Code project-file flaws
- Snyk: ToxicSkills findings
- Air Security: The Circus of Skills
- Air Security: The Story of Skills
- Microsoft: OpenClaw isolation and runtime risk
- Trail of Bits: the state of SKILL distribution
For these risks in real incidents, read the Civilizations threat briefings.
Find out which SKILLs are already installed
Optimus Labs discovers every SKILL, MCP server, and agent across endpoints, cloud environments, and wherever agents run, scores what each one can do, and watches what it does at runtime.
