Malicious agent skills and AGENTS.md: the new coding-agent supply chain

01Why is a SKILL.md file effectively code?

A skill is a folder with a SKILL.md file, and optionally reference files and scripts. In Claude Code, skills load from your home folder, from a project's .claude/skills directory, or from a plugin. Only each skill's description sits in context until the skill is invoked; then its full text is loaded and stays in the conversation. A skill can bundle scripts and run them, and its allowed-tools field pre-approves tools for the turn that invokes it.

Anthropic's own documentation flags the risk in the repository case. Workspace trust does not gate allowed-tools: Claude Code applies a project skill's grant even in a folder you have never trusted, and a skill can grant itself broad tool access, so the docs advise reviewing the allowed-tools of skills checked into a repository before running Claude Code there.

Snyk's threat model, published in February 2026, states the general point: skills do not request discrete permissions. They add instructions that the agent carries out with the permissions it already has, so if the agent has shell, file and network access, every skill you install inherits that. As Snyk puts it, everything in a skill's markdown is a potential command.

02What did Snyk's ToxicSkills study find?

Snyk's ToxicSkills report, published on 5 February 2026, scanned 3,984 skills from ClawHub, the registry for the OpenClaw agent, using the top 100 skills on skills.sh as a baseline. It reported that 13.4% of skills, 534 in all, had at least one critical-level issue, and 36.82%, or 1,467, had at least one security issue of any severity. Human review confirmed 76 malicious payloads aimed at credential theft, backdoors and data exfiltration, and 8 of those skills were still public on ClawHub when the report was published.

The confirmed malicious skills worked on two layers at once. All of them contained malicious code patterns, and 91% also used prompt injection in the markdown, so a reviewer reading only the script or only the prose would miss half the attack. Snyk's separate write-up of the ClawHavoc campaign describes 341 malicious skills out of 2,857 audited on ClawHub, from a campaign that ran between 27 and 29 January 2026 and delivered the AMOS infostealer for macOS. Snyk notes that the only barrier to publishing on ClawHub was a GitHub account at least a week old.

• Typical payloads: password-protected archives and unsigned binaries, base64-encoded exfiltration commands, persistent backdoors.
• Typical targets: API keys, SSH credentials, wallet files and browser passwords.
• Persistence: edits to agent memory files such as SOUL.md and MEMORY.md that outlive the skill.

03How does an AGENTS.md file become an attack?

AGENTS.md is a plain Markdown file of instructions for coding agents, now stewarded by the Agentic AI Foundation under the Linux Foundation. Its site lists more than 20 tools that read it, including Codex, Jules, Gemini CLI, Cursor, Aider and GitHub Copilot's coding agent. The nearest file in the directory tree takes precedence, and agents run the test commands it lists. That is exactly what makes it useful, and exactly what makes it an injection point.

BleepingComputer reported a real case on 25 October 2026. Forever Security traced an agent's attempt to install a malicious npm package called function-color to an AGENTS.md file in a customer's ~/Downloads folder, which was also the agent's working directory. The researchers reproduced the chain against Codex with a harmless payload and showed a related technique in Claude Code, in which a CLAUDE.md file redirected API traffic to a server they controlled. They pointed out that a web page can drop a file into Downloads, and that there was nothing for the vendors to patch: the agents did what instruction files are for.

Instruction files can also hide their payload from people. In March 2025 Pillar Security described a Rules File Backdoor, in which invisible Unicode characters in Cursor and GitHub Copilot rules files carried instructions that human reviewers could not see but the model followed. GitHub later added a warning on github.com when a file contains hidden Unicode text.

04What does the OWASP Agentic Skills Top 10 recommend for AST01?

OWASP's Agentic Skills Top 10, an incubator project, rates AST01 Malicious Skills as critical for every platform it names, including OpenClaw, Claude Code, Cursor and VS Code. It lists the techniques seen so far: typosquatted skill names, prerequisites sections that ask the user to paste terminal commands from an attacker's domain, fake setup dialogs, backdoor instructions written into identity and memory files so they survive uninstalling, and WebSocket connections to a command server. Its explanation of the impact matches Snyk's: a skill runs with the host agent's permissions.

Its mitigations are worth copying into a team policy. Require signatures tied to revocable publisher identities, while remembering, as OWASP says, that a signature proves authorship, not safety. Scan skills at publish and install time, pin installed skills by hash and alert on any change, never auto-run prerequisites, log what skills do, and isolate skill execution in containers or sandboxes. OWASP's broader Top 10 for Agentic Applications covers the same ground as ASI04 Agentic Supply Chain Vulnerabilities and ASI06 Memory and Context Poisoning.

05How do you shrink what a malicious skill inherits?

Review and scanning reduce the chance of installing a bad skill. They cannot bring it to zero, because the payload can be prose that looks like ordinary setup advice. So the second half of the defence is to make the agent's permissions small enough that a skill that slips through finds little to take and nowhere to send it.

Start with the working directory, since that decides which instruction files load: run agents from the project folder, never from ~/Downloads or your home directory. Then remove what a skill could steal or use, and keep a way back.

• Read every third-party SKILL.md, its scripts and its allowed-tools line before enabling it; pin the version you read.
• Run the agent in a machine that sees only the project folder, not your SSH keys, browser profile or wallet files.
• Keep API keys outside that machine and close its network to an allow-list, so a stolen secret has nowhere to go.
• Take a whole-machine checkpoint before trying a new skill, and rewind if it misbehaves.
• If a malicious skill did run, rotate every credential it could reach and check memory files for edits.