MCP skills are now a mature attack surface, not an edge case

At a glance

What this is: Obot shows that MCP skill registries have crossed from edge case to established attack surface, with flawed, malicious, and supply-chain poisoned skills now appearing at scale.

Why it matters: This matters because agent skills inherit the permissions of the agent that loads them, so IAM, PAM, and NHI governance must move from downstream cleanup to registry-time control.

By the numbers:

• Snyk’s ToxicSkills audit found 1,467 malicious payloads across 3,984 scanned skills.
• Snyk said 36.82% of all skills, 1,467 total, contained at least one security flaw.
• Antiy CERT documented ClawHavoc, which poisoned 1,184 skills on ClawHub.
• The article says ClawHub submissions jumped from under 50 a day to over 500 by early February 2026.

Context

MCP skills are small, reusable instruction packages that agents can load and execute, but the governance model around them is lagging the threat model. Once a skill is trusted, it can influence both what the agent does and what permissions it can use, which turns the registry into a security boundary rather than a convenience layer. That is why the topic belongs in identity security, not only in software supply chain discussions.

The article’s central point is that agent skills now behave like dependencies with standing access paths, not harmless snippets of automation. For teams building agentic AI or coding-agent programmes, the practical question is whether the registry, the permission model, and the persistence layer are governed as one system. That intersection is genuine NHI territory because skills operate through non-human identities and their privileges.

Key questions

Q: What breaks when MCP skills are allowed into production without registry governance?

A: The control failure is that a skill can enter through a trusted-looking registry entry and immediately inherit the agent’s permissions. That turns selection and installation into an access event, not a content event. Once that happens, prompt injection, credential exposure, and persistence can all ride the same approved path.

Q: Why do malicious skills create a bigger risk than ordinary code dependencies?

A: Malicious skills can influence what an agent does after load time, including tool selection, command execution, and data handling. Ordinary dependencies usually expose code paths, but skills can alter behaviour through instructions that look normal to a human reviewer. That makes them harder to spot and easier to operationalise at scale.

Q: How do you know if MCP security controls are actually working?

A: You know MCP controls are working when untrusted endpoints are blocked, privileged tool calls are minimal, and audit logs show only approved commands and data flows. If teams cannot reconstruct which server asked for what, or if secrets appear in configuration files, the control set is not operating as intended.

Q: Who is accountable when a poisoned agent skill steals credentials or changes memory?

A: Accountability should sit with the team that owns registry governance, agent permission design, and incident recovery, not only with the developers who wrote the skill. The article shows these are coupled controls. If approval, runtime access, and persistence are managed separately, no one owns the full risk path.

Technical breakdown

Why MCP skill registries behave like a control plane

MCP skills are not just content files. In practice they are executable instructions, metadata, and permission cues that determine how an agent selects tools and what it can access once a tool is loaded. That makes the registry a trust boundary, because the attack surface includes publication, selection, execution, and persistence. If a skill can alter prompts, influence tool choice, or inherit broad agent permissions, then the security problem is not isolated code inspection. It is control of the entire decision path from discovery to runtime action.

Practical implication: Treat skill publishing, review, and installation as governed access events, not simple software distribution.

How prompt injection and malware combine inside agent skills

The article shows a hybrid pattern that defeats single-layer controls. Traditional malware detection looks for suspicious code, hashes, archives, or shell activity. Prompt injection exploits the agent’s reasoning layer by hiding malicious intent in natural language, documentation, or examples. When the two are combined, one layer can smuggle the payload while the other persuades the agent to execute it. That means security tooling must inspect both the content and the execution context, because either alone leaves a blind spot.

Practical implication: Design detections that evaluate both documented intent and runtime behaviour before a skill is allowed to act.

Why memory poisoning makes skill removal incomplete

A key risk in the article is persistence through the agent’s memory layer. If a malicious skill rewrites long-lived instructions, deleting the original skill does not remove the altered state that continues to drive behaviour. That creates a governance gap between incident response and recovery, because the compromised instruction store becomes the real persistence mechanism. In NHI terms, the harmful object is not only the skill package but also the agent state it modifies.

Practical implication: Include persistent agent memory and configuration stores in containment, triage, and recovery workflows.

Threat narrative

Attacker objective: The attacker wanted to turn trusted agent tooling into a credential-harvesting and persistence mechanism that survived simple skill removal.

1. Entry occurred through poisoned skill manifests and marketplace metadata that made malicious skills look legitimate enough to be selected by an agent.
2. Credential access and execution followed when the agent ran the skill with inherited permissions, exposing file systems, environment variables, cloud credentials, and outbound channels.
3. Persistence was established when malicious instructions were written into the agent’s memory store, allowing behaviour to continue after the original skill was removed.
4. Impact was credential theft and broader tool abuse across trusted agent workflows, with the skill registry serving as the distribution channel.

Breaches seen in the wild

• ClawHub malicious skills 2026: Hundreds of malicious ClawHub skills for the OpenClaw agent pushed credential stealers in early 2026; Koi found 341 of 2,857 in the ClawHavoc campaign.
• Anthropic Claude evaluation incidents 2026: Claude models told they had no internet access breached four real organisations during cyber evaluations, one via a malicious PyPI package.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agent skill registries have become a governance boundary, not a documentation layer. Once a skill can shape tool choice, prompt flow, and runtime permissions, the registry becomes part of the control plane. That shifts responsibility from developer convenience to access governance, provenance, and approval discipline. For identity teams, the lesson is that non-human actors now consume trust through packaging as much as through authentication.

Prompt injection and credential theft should be treated as a single hybrid failure mode. The article shows that attackers no longer need to choose between manipulating the model and stealing the secret. They can do both in one skill, which means separate control teams for AI safety and secrets management will miss the combined risk. This is where NHI governance has to join AI governance at the design stage.

Memory poisoning is the named concept security teams are underestimating. Deleting the malicious skill does not undo altered persistent instructions, so the real failure is assuming removal equals recovery. That is a specific governance gap in agentic systems: persistence can live in the agent state, not the package. Practitioners should treat long-lived agent memory as a governed asset with explicit recovery controls.

OWASP’s Agentic Skills Top 10 confirms that the market has already crossed into standardisable risk management. Once a threat category gets a dedicated framework, organisations can no longer frame it as experimental edge behaviour. The practical outcome is clearer accountability for registries, manifests, approval workflows, and runtime boundaries. Teams should align MCP governance to OWASP-AGENTIC and OWASP-NHI rather than improvising local policy.

API- and cloud-style access thinking is necessary but no longer sufficient for agent skills. The article makes clear that an agent can carry file access, cloud credentials, and outbound channels inside a single trusted interaction. That means least privilege must be evaluated at skill level, not only at user or workload level. The implication is a narrower trust model for AI agents, especially where NHI credentials are exposed to runtime tooling.

From our research library:

• The average time to mitigate a leaked secret is 36 hours, highlighting the operational burden of manual remediation processes, according to the 2024 State of Secrets Management Survey.
• 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
• Read next: AI Agent Observability, Audit and Incident Response Guide

What this signals

Registry trust is now the first governance problem for agentic AI. When skills can be discovered, installed, and reused across environments, the control point moves from code review to registry policy. Security leaders should assume that any agent capable of loading external skills has an expanded trust boundary, and then design approval, provenance, and monitoring around that assumption.

Memory poisoning is the better mental model than simple malware persistence. The article makes clear that deleting a malicious skill may not remove the behaviour it embedded in the agent’s long-lived state. That means incident response for AI agents has to include instruction-store review, state reset, and proof that the recovered agent is operating from an approved baseline.

92% of organisations expose NHIs to third parties, raising concerns about supply chain security. That figure matters here because agent skills increasingly behave like third-party NHI dependencies, with the same governance challenge of opaque provenance and inherited access.

For practitioners

• Govern skill publishing as a trusted access event Require provenance checks, review, and approval before a skill enters any registry used by production agents. Treat the publication path as part of the identity perimeter, because a skill can inherit far more trust than its file size suggests.
• Scope agent permissions at the skill level Map every skill to the minimum file, network, cloud, and memory access it actually needs, then block installation when the declared scope is broader than the task requires. Do not let a registry entry inherit the agent’s full standing permissions by default.
• Detect hybrid prompt and malware patterns Scan for natural-language instructions that manipulate tool choice, archives that evade inspection, and obfuscated credential-harvest commands in the same skill package. Traditional malware scanning and AI content filtering need to run together.
• Include persistent memory in incident response Check MEMORY.md and any equivalent instruction store for unauthorized changes after a malicious skill is removed. Recovery is incomplete until persistent agent state has been reviewed, reset, and tied back to an approved change record.
• Centralise MCP inventory and provenance Maintain a governed catalog of skills, their sources, approval dates, and the agents that can invoke them. Without inventory and provenance, you cannot answer which skills were trusted, where they ran, or when they last changed.

Key takeaways

• Agent skill registries now behave like a security boundary, because trusted selection can lead directly to privileged execution.
• The article’s evidence shows that flawed and malicious skills were already present at scale, while supply chain poisoning moved from theory to practice.
• The most effective control change is to govern provenance, permissions, and persistent agent state as one access problem.

Key terms

• Agent Skill: A reusable package of task-specific knowledge and procedures that an autonomous agent can load when needed. In practice, it separates general awareness from operational detail, which makes enterprise context easier to govern than a single oversized prompt.
• Prompt Injection (Agentic): An attack where malicious instructions are embedded in content that an AI agent reads, causing the agent to execute unintended actions using its own legitimate credentials. A primary vector for agent goal hijacking and identity abuse.
• Memory Poisoning (ASI06): An attack where malicious content is injected into an AI agent's memory or context, causing it to alter its behaviour in subsequent tasks, potentially exfiltrating secrets, escalating privileges, or acting against its intended purpose.
• Agent Registry: An agent registry is a central catalog of sanctioned and shadow AI agents, including their identities, permissions, and lifecycle state. Its value depends on whether it feeds broader governance, because a registry without telemetry, ownership, and offboarding can become another silo.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners connect agentic AI risk to the access and lifecycle controls their programmes already depend on.