Malicious skills make agentic AI the next supply chain risk

At a glance

What this is: This research argues that malicious skills are emerging as a supply chain risk for agentic AI, with runtime instruction files and bundled code enabling covert abuse.

Why it matters: It matters because IAM, NHI, and AI governance teams must now treat agent skills like untrusted identity-bearing dependencies, not harmless configuration.

By the numbers:

• One of the biggest repositories to date is ClawHub, containing over 70k skills as of June 2026.
• OpenClaw gained over 370k stars on GitHub in less than half a year’s time.

👉 Read HiddenLayer's analysis of malicious skills in agentic AI

Context

Malicious skills in agentic AI are instruction packages that shape what an agent does at runtime, including which tools it uses, which commands it executes, and how it handles results. The primary governance problem is not just code execution, but unvetted third-party instructions becoming trusted input inside enterprise workflows, which is why this is now an identity and access issue as much as a software supply chain issue.

The article’s central claim is that agentic AI has turned skills into a distribution channel for malicious behaviour, and that enterprise developers will be exposed first because their agents sit next to source code, cloud credentials, CI tokens, and internal APIs. That makes skills a governance boundary problem for NHI, autonomous systems, and the human operators who install them.

Key questions

Q: How should security teams govern third-party skills used by AI agents?

A: Security teams should treat third-party skills as untrusted runtime inputs, not harmless extensions. That means requiring signed packages, verified publisher provenance, approval workflows, and sandboxed execution before an agent can load the skill. The control objective is to prevent behavioural instructions from inheriting the same trust as the agent itself.

Q: Why do malicious skills create a bigger risk than ordinary code dependencies?

A: Malicious skills can influence what an agent does after load time, including tool selection, command execution, and data handling. Ordinary dependencies usually expose code paths, but skills can alter behaviour through instructions that look normal to a human reviewer. That makes them harder to spot and easier to operationalise at scale.

Q: What do organisations get wrong about agentic AI supply chain risk?

A: They often scan for malware inside files and miss the instruction layer that changes agent behaviour. A clean-looking skill can still redirect outputs, trigger unsafe commands, or manipulate decisions. The mistake is treating skills like documentation when they function more like operational policy for the agent.

Q: Who is accountable when an agent runs a malicious skill and causes damage?

A: Accountability sits with the organisation that allowed the skill into the agent environment and with the team that defined the agent’s permissions and review process. The issue is governance of the full execution chain, including publisher trust, runtime isolation, and permission scope, not just the individual user who clicked install.

Technical breakdown

How malicious skills hijack agent runtime behaviour

A skill is a runtime instruction set, usually built around a SKILL.md file plus optional scripts and supporting files. The agent reads those instructions while it is operating, then uses them to decide how to invoke tools, what commands to run, and how to process outputs. That means the attack surface is not limited to executable code. A malicious skill can embed persuasive instructions, redirect outputs to attacker-controlled infrastructure, or quietly alter how the agent interprets tasks. Because the skill is consumed inside the agent loop, the payload becomes part of normal operation rather than a separate event.

Practical implication: treat skill content as executable policy input and inspect it before the agent ever loads it.

Why unsigned skills create supply chain exposure

The core weakness is provenance. Skills can be published through public repositories, mirrors, and curated lists without a robust trust model, and they are rarely cryptographically signed or meaningfully reviewed. That makes tampering, copycat packages, and bundled dependency abuse hard to distinguish from legitimate distribution. The risk is similar to package-manager compromise, but worse in one respect: a skill can look harmless in the file header while hiding behavioural instructions or bundled scripts that only activate once the agent executes them. In agentic environments, trust without verification becomes an identity control failure.

Practical implication: require publisher verification, content hashing, and approval gates before skills are allowed into production workflows.

Why autonomous agents magnify the blast radius

Agents do not just read skills, they act on them. When those agents can browse, write files, invoke shells, and reach internal systems, a malicious skill can use the agent’s own permissions to move beyond a single workstation. That changes the risk from a local compromise to downstream propagation across codebases, credentials, and procurement or recommendation flows. The same mechanism that makes agents useful also lets attacker-authored instructions ride on legitimate automation paths. In other words, the blast radius is determined by what the agent can touch, not by how convincing the skill file looks.

Practical implication: sandbox agent skills so a compromised instruction set cannot reach broad filesystem, network, or tool permissions.

Threat narrative

Attacker objective: The attacker wants to convert trusted agent behaviour into covert execution, data exposure, or downstream supply chain manipulation.

1. Entry begins when a user installs or the agent ingests a malicious skill from a public repository, mirror, or curated list. Credential access occurs when the agent runs the skill and follows its instructions with access to local code, cloud keys, or internal APIs. Escalation happens when the skill redirects tool use, launches bundled scripts, or manipulates recommendations in ways that expand the attacker’s reach beyond the original workstation. Impact is achieved when the agent exfiltrates data, executes malware, or propagates attacker-controlled behaviour into enterprise systems.

Breaches seen in the wild

• Moltbook AI agent keys breach — Moltbook breach exposed 1.5M AI agent keys.
• LiteLLM PyPI package breach — LiteLLM PyPI supply chain attack, credentials stolen from users.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Malicious skills are the new untrusted identity boundary for agentic systems. A skill is not just configuration. It is runtime instruction that can shape tool use, command execution, and decision flow inside an agent. That means the trust decision moves from code review to behavioural authorization, which is exactly where traditional software governance is weakest. Practitioners should treat skill ingestion as a control point, not a convenience feature.

Skill marketplaces create a supply chain problem that looks like IAM but behaves like malware distribution. The article shows that anyone can publish a skill and agents will execute it, which breaks the assumption that useful automation is also trustworthy automation. In practice, provenance, signing, and review are now part of identity governance for agent tooling, because the agent is acting on behalf of a user while consuming third-party instruction sets.

Enterprise risk rises because developer workstations already hold the credentials and artefacts attackers want. Source code, cloud keys, CI tokens, and internal APIs are all reachable from the same endpoint where a malicious skill can run. That makes developer agents a convergence point for NHI exposure, software supply chain compromise, and autonomous execution. The practitioner conclusion is that endpoint identity, workload identity, and agent governance can no longer be separated.

OWASP-style agentic controls matter here because the failure is not only malicious code, but unsafe trust in agent inputs. The relevant risk pattern includes prompt-style instruction abuse, excessive tool permissions, and weak isolation between agent and skill. Security teams should read this as a control-mapping problem across agent runtimes, package trust, and runtime containment, not as a narrow content-scanning issue.

Named concept: skill trust debt. The ecosystem is accumulating operational dependence on third-party skills faster than it can establish verification, provenance, or isolation. That debt grows every time a team installs a skill because it is useful today and assumes review can happen later. Practitioners need to see that the debt compounds across every agent, workstation, and repository that consumes the same untrusted instruction model.

From our research:

• One of the biggest repositories to date is ClawHub, containing over 70k skills as of June 2026, according to LLMjacking.
• The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
• For a broader threat baseline, the 52 NHI breaches Report shows how quickly identity exposure becomes a downstream attack path once trust is lost.

What this signals

Skill trust debt: agent teams now need an explicit review model for third-party instructions, because every skill added to a workflow expands the attack surface before any code is written. With over 70k skills already present in one major registry, the governance problem is no longer theoretical and should be treated like a supply chain intake control.

The practical signal for IAM and NHI programmes is that agent permissions, endpoint trust, and software supply chain controls are converging. Teams that already map service accounts, secrets, and tool privileges should extend that same inventory logic to agent skills, registry sources, and the workstations where developers install them.

This is also where external guidance becomes useful: the OWASP Agentic AI Top 10 and the CSA MAESTRO agentic AI threat modeling framework both reinforce that agent input trust and tool isolation must be treated as first-class design controls.

For practitioners

• Gate skill ingestion by provenance and approval Require publisher verification, signed packages, and explicit approval before any agent can load a third-party skill into a developer or enterprise environment.
• Sandbox agent skills by default Constrain filesystem access, network egress, and shell execution so a malicious SKILL.md cannot reach secrets or pivot into internal systems.
• Inventory every agent-facing extension source Map where skills, plugins, and context files are pulled from, including GitHub repositories, mirrors, and curated lists used by developers.
• Apply content review to behavioural instructions Check what a skill instructs an agent to do, not just whether the package contains recognizable malware or suspicious binaries.
• Separate developer convenience from production trust Allow experimentation on personal machines, but require controlled registries and restricted permissions before skills can touch corporate code or credentials.

Key takeaways

• Malicious skills turn agentic AI into a supply chain problem because trusted runtime instructions can change what an agent does after installation.
• The scale is already visible in the ecosystem, with large public skill registries and rapidly adopted agent platforms creating a wide attack surface.
• Practitioners need signed provenance, sandboxed execution, and behavioural review for agent inputs before skills can be allowed into sensitive environments.

Key terms

• Skill: A skill is a modular instruction package that teaches an agent how to perform a task at runtime. It can include a markdown instruction file, metadata, scripts, and supporting documents. In agentic environments, a skill is not passive documentation. It is an active control input that can shape behaviour, tool use, and execution.
• Agent runtime: Agent runtime is the period when an AI agent is actively interpreting context, selecting tools, and acting on tasks. This is where skills matter most, because the agent consumes instructions and executes them immediately. The runtime boundary is where provenance, isolation, and permission controls either contain risk or fail open.
• Skill trust debt: Skill trust debt is the accumulation of operational dependence on third-party instruction packages before verification, signing, and isolation controls exist. It grows when teams value convenience and speed over governance. The more skills a programme adopts without review, the more difficult it becomes to distinguish useful automation from embedded abuse.
• Behavioural manipulation: Behavioural manipulation is the use of instructions, examples, or metadata to steer an agent into unsafe or attacker-favourable actions without obvious malware. It targets the decision layer rather than the file system or binary layer. This makes the risk harder to detect with traditional scanning and more dependent on runtime governance.

What's in the full report

HiddenLayer's full research covers the operational detail this post intentionally leaves for the source:

• A deeper breakdown of the OpenClaw skill architecture, including how SKILL.md, YAML metadata, and bundled files interact at runtime.
• Examples of malicious skill behaviours in the wild, including malware download patterns and covert manipulation cases.
• Mitigation patterns such as repository vetting, runtime analysis, command allow lists, and sandboxing approaches for agent workloads.
• The article’s discussion of OWASP Agentic Applications and AST10 as mapping tools for agentic supply chain risk.

👉 HiddenLayer's full research covers the OpenClaw case study, malicious skill patterns, and mitigation layers in more detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or operational governance, it is worth exploring.