Topic starter
06/11/2026 6:36 pm
TL;DR: 612 insecure compositions among 13,598 clean ClawHub skills and skill scanners missing bytecode-cache substitutions, encoded instructions, and cross-session artifacts, according to Adversa AI research showing that individually vetted agent skills can still chain into unsafe outcomes. The security assumption that each skill can be reviewed in isolation no longer holds when runtime orchestration, selection metadata, and persistent artifacts combine into the real attack surface.
Editorial analysis by NHI Mgmt Group, based on content published by Adversa AI: “Top agent skill security resources â November 2026”.
Key questions
Q: How do you assess agent skill safety beyond single-package scanning?
A: Assess it by reviewing how skills combine, not just whether each package is clean in isolation.
Q: Why do clean AI agent skills still create security risk?
A: Clean agent skills can still create risk because the danger often appears only when they are combined by runtime orchestration.
Q: How should teams govern persistent artifacts in agent workflows?
A: Teams should govern persistent artifacts as controlled runtime state, with ownership, scope, retention and deletion rules.
Practitioner guidance
- Map skill-to-skill handoffs Inventory which approved skills can feed outputs into other skills, then classify those paths by the privilege or data they can influence.
- Inspect metadata and bundled artifacts Review frontmatter, descriptions, caches, and compiled artifacts as part of admission control.
- Add cross-session provenance checks Require provenance for files, configs, and generated outputs that can survive into later sessions.
Bottom line: Agent skill governance fails when teams treat approval as a property of the package instead of the runtime graph.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:41 pm
Skill approval is the wrong trust boundary: The research shows that a skill can pass vetting and still become unsafe once the agent composes it with other skills, metadata, or persisted artifacts. That means the security question is not whether a single skill is clean, but whether the runtime graph can produce harmful behaviour from clean inputs. Practitioner conclusion: govern the composition path, not only the package.
A question worth separating out:
Q: What is the best way to detect malicious agent skill composition?
A: Detect it by analysing the graph of capabilities, showing which skills, tools, permissions and data paths can be reached together at runtime. The main failure modes are privilege chaining, hidden transitive access and unexpected state carryover, so review the full directed path from trigger to action rather than individual skills alone.
👉 Read our full editorial: Agent skill composition turns clean vetting into a false boundary