Agent skills and MCP configs: are your domain controls keeping up?

TL;DR: 121 agent components, including 108 skills, 11 MCP servers and 2 plugins, still use 100 high-risk domains in live configurations, according to Manifold Security, while a ClawHub skill silently installs a miner that reports to botnet command-and-control and leaks machine identifiers. The core governance problem is that agents treat URLs as instructions, so domain trust has to be verified before execution, not after.

Editorial analysis by NHI Mgmt Group, based on content published by Manifold Security: “The High-Risk Domains of Agent Skills and Where They Lead”.

By the numbers:

• The article says 121 agent components still use a high-risk domain for real.
• Finance skills make up 43% of the skills that use a high-risk domain, against 6% of all skills.

Key questions

Q: What breaks when an agent skill trusts a domain that later becomes malicious?

A: The trust model breaks because the agent executes a live dependency, not a static reference.

Q: Why do high-risk domains in MCP and skill workflows create more than malware risk?

A: They create an access governance problem because the domain can control what code runs, what data leaves the host and whether the session leaves behind persistent state.

Q: How should security teams detect risky agent dependencies before they execute?

A: Use pre-execution checks against threat feeds, protective DNS and blocklists, then review the installer's actual network destinations and persistence behaviour.

Practitioner guidance

• Audit every external domain in agent workflows Inventory the domains referenced in skills, MCP configs and plugins, then classify them as allowed, unknown or prohibited before any agent executes them.
• Preflight reputation checks before execution Check each referenced domain against protective DNS, threat feeds and malware filters before the component is loaded, not after the agent has connected.
• Block persistence from agent-installed tools Look for LaunchAgents, systemd user units and similar persistence mechanisms whenever a skill or installer changes host state.

Bottom line: Agent skills and plugins can smuggle in high-risk domains that control code execution, telemetry and persistence.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →