Installing a skill is installing someone else's instructions into your agent's context. It is a dependency with none of the tooling that package managers took years to build.
- A February 2026 audit of 3,984 agent skills found 13.4% contained at least one critical-severity issue.Snyk, “ToxicSkills”, 5 Feb 2026, quote re-read 22 Sep 2026: “13.4% of all skills, or 534 in total, all contain at least one critical-level security issue”.
- 76 confirmed malicious payloads built for credential theft, backdoor installation and data exfiltration.
- Over a third had at least one security flaw of any severity — including prompt injection, text that redirects the agent reading it.
- There is no lockfile, no signature, no advisory database. You are the review process.
A "skill" is a text file you add to an AI assistant to teach it a task. The assistant reads it and treats it as an instruction.
So installing one from a stranger is like handing someone a note and asking them to do whatever it says. If the note contains something you did not expect, the assistant has no way to know it should not obey.
What you are actually installing
A skill is text that gets loaded into an agent's context and treated as instruction. That is the whole mechanism, and it is why the risk is different in kind from a library.
A malicious library has to execute. A malicious skill only has to be read. Once its text is in context, the agent cannot reliably distinguish it from something you wrote — which is the same structural problem described on guardrails.
The measured position, from a scan of nearly four thousand published skills:Snyk, "ToxicSkills", 5 Feb 2026, read at source 11 Sep 2026 and quotes re-read 17 Sep 2026: “13.4% of all skills, or 534 in total, all contain at least one critical-level security issue” across 3,984 skills scanned from ClawHub and skills.sh; “over a third of the ecosystem is affected: 36.82% (1,467 skills) have at least one security flaw”, and “our human-in-the-loop process confirming that 76 of Agent Skills contained malicious payloads”. — 3,984 skills scanned
What is actually out there
Abstract risk is easy to ignore, so here are five widely-installed skills and what each one is asking for.
And one figure on this list was not a skill at all. "Playwright, 88k" almost certainly refers to Microsoft's Playwright testing framework, not to any Claude skill wrapping it. The skills that do wrap it are small, and there are several. A framework's popularity had been silently transferred to a skill that borrows its name — which is a more useful warning than any star count: check what you are actually installing, not what it is named after.
Those are ranges, not numbers, and the ranges are the finding. Verified 22 Aug 2026: UI/UX Pro Max is reported at 29,636 (Snyk, Mar), 94k (Superdesign, Jun) and 118,288 (Skillselion, 20 Aug). Taste at 59.4k in March and 48k in June. Impeccable at 44k in March and 40k in June. Published figures for the same repository differ by two to four times depending on who counted and when — and some counts fall over time, which can mean people removed stars or that the sources counted differently. Recompute against api.github.com before relying on any of them. The Snyk, Superdesign and Skillselion figures were read from those publications; no links were kept. On 23 Sep 2026 GitHub’s API for nextlevelbuilder/ui-ux-pro-max-skill returned “stargazers_count: 129888”.
Read that list again with the permission question in mind. Playwright opens a browser and drives your application. That is a fundamentally different ask from a skill that only shapes text output — and the star count tells you nothing about whether it should have it.
Popularity is a measure of how many people installed it, not of how many read it first.
A correction, made while fact-checking this page. An earlier version of this section said Huashu-Design carried "MIT with a commercial-use condition" and drew a conclusion from it. That was wrong, and it was wrong in an instructive way.
The screenshot it came from showed MIT* with an asterisk and a commercial-licence note. That was the licence until 14 May 2026, when the project moved to plain MIT — commercial use free, no prior authorisation, no fee.alchaincyf/huashu-design README and LICENSE, checked 22 Aug 2026
So the caution stands, but the example inverts: the licence this page was warning about had already been fixed three months earlier. A licence read from a screenshot is a licence at whatever date that screenshot was taken — and licences change in both directions.
What to check before installing one
- Read it. All of it. A skill is text — usually short. If it is too long to read, that is itself the finding.
- Does it reference anything outside itself? A URL it fetches, a file it reads, an endpoint it posts to. Each is a channel out.
- Does it ask for permissions the task does not need? A formatting skill needing network access is the clearest signal there is.
- Does it contain instructions about instructions? "Ignore previous", "always", "regardless of" — language aimed at the agent's obedience rather than the task.
- Who publishes it, and does the account have history? A skill published last week by an account with nothing else is not a package with a maintainer.
A malicious library has to execute. A malicious skill only has to be read.
What the ecosystem does not have
Worth naming plainly, because the absence is easy to miss when installation is one click:
- No lockfile. A skill can change under you between runs.
- No signature. Nothing proves the author is who the listing says.
- No advisory database. When a skill is found malicious, there is no channel that tells you.
- No dependency graph. A skill invoking another skill is invisible until it happens.
npm took years to build those. Skills are at year one and moving faster.
The working rule
Treat a skill as you would a script from a stranger, because that is exactly what it is. Read it, run it at tier one first, and check what it did against what it claimed.
And pin the ones you rely on. A skill you have read is a skill you have read at one version — nothing guarantees the next one is the same.