Notifications
Clear all
Topic starter
18/08/2026 3:02 pm
TL;DR: Snyk’s ToxicSkills audit found 1,467 flawed skills across 3,984 scans, while Antiy CERT’s ClawHavoc analysis showed malicious supply chain poisoning at registry scale, per Obot’s reporting. The core issue is governance lag: agent skills inherit agent permissions, so prompt injection, memory poisoning, and credential theft become a single control problem rather than separate risks.
NHIMG editorial — based on content published by Obot: MCP Security: The Numbers Behind the Problem
By the numbers:
- Snyk’s ToxicSkills audit scanned 3,984 skills and found 1,467 containing at least one security flaw.
- The ClawHavoc campaign weaponized 900 of ClawHub’s 4,500 skills, roughly one in five, according to the article.
- Snyk’s research confirmed 76 malicious skills with active payloads, showing that registry abuse had already moved beyond theory.
Questions worth separating out
Q: What breaks when third-party agent skills are not governed like privileged inputs?
A: When agent skills are treated as harmless content, organisations miss the fact that those instructions can steer tools, secrets, and execution paths.
Q: Why do malicious skills create a bigger risk than ordinary code dependencies?
A: Malicious skills can influence what an agent does after load time, including tool selection, command execution, and data handling.
Q: How do security teams know whether a Skill is operating outside its intended boundary?
A: Look for unexpected tool calls, commands that were not part of the approved workflow, unusual access to secrets or files, and divergence between the user request and the agent’s executed steps.
Practitioner guidance
- Classify every agent skill as a governed dependency Require ownership, provenance, and approval for each skill before it reaches production agents.
- Validate instruction content and executable content separately Run scanning for malware patterns, prompt-injection cues, and disguised examples in documentation, templates, and manifests.
- Scope agent permissions to the minimum skill use case Remove inherited broad access to file systems, cloud credentials, and outbound channels where the task does not require them.
What's in the full article
Obot's full analysis covers the operational detail this post intentionally leaves for the source:
- Registry-level remediation guidance for poisoned skills, including how to verify provenance and revoke unsafe publications
- Detailed breakdowns of the ClawHavoc attack chain, including memory poisoning and credential exfiltration mechanics
- The specific control patterns used to detect prompt injection embedded in skill documentation and templates
- Operational guidance for centralising agent skill approval, audit, and lifecycle management
👉 Read Obot’s analysis of MCP skill poisoning and ClawHavoc →
MCP skills and agent registries: what security teams are missing?
Explore further
18/08/2026 3:41 pm
Registry governance is now an identity control, not a developer convenience. The article shows that agent skills inherit the permissions of the host agent, which makes publication, approval, and revocation part of access governance. That is the same lifecycle problem IAM teams already manage for service accounts and tokens, except the unit of control is now a skill package rather than a static account. Practitioners should treat skill registries as governed identity infrastructure.
A question worth separating out:
Q: Who is accountable when a malicious skill persists after removal?
A: The accountable party is the team that owns the skill lifecycle and the agent runtime, because remediation must cover durable state as well as the removed artifact. If memory, policy stores, or approvals were not checked, the incident response was incomplete.
👉 Read our full editorial: MCP skills are now a mature attack surface, not an edge case
