Installing a skill is installing someone else's instructions into your agent's context. It is a dependency with none of the tooling that package managers spent twenty years building.
- A February 2026 audit of 3,984 agent skills found 13.4% contained at least one critical-severity issue.
- 76 confirmed live malicious payloads built for credential theft and data exfiltration.
- 36% contained prompt-injection vectors — text that redirects the agent reading it.
- There is no lockfile, no signature, no advisory database. You are the review process.
A "skill" is a text file you add to an AI assistant to teach it a task. The assistant reads it and treats it as an instruction.
So installing one from a stranger is like handing someone a note and asking them to do whatever it says. If the note contains something you did not expect, the assistant has no way to know it should not obey.
What you are actually installing
A skill is text that gets loaded into an agent's context and treated as instruction. That is the whole mechanism, and it is why the risk is different in kind from a library.
A malicious library has to execute. A malicious skill only has to be read. Once its text is in context, the agent cannot reliably distinguish it from something you wrote — which is the same structural problem described on guardrails.
The measured position, from a scan of nearly four thousand published skills:Snyk, "ToxicSkills", 5 Feb 2026 — 3,984 skills scanned
What is actually out there
Abstract risk is easy to ignore, so here are five widely-installed skills and what each one is asking for.
Those are ranges, not numbers, and the ranges are the finding. Verified 22 Aug 2026: UI/UX Pro Max is reported at 29,636 (Snyk, Mar), 94k (Superdesign, Jun) and 118,288 (Skillselion, 20 Aug). Taste at 59.4k in March and 48k in June. Impeccable at 44k in March and 40k in June. Published figures for the same repository differ by two to four times depending on who counted and when — and some counts fall over time, which a star count cannot do. Recompute against api.github.com before relying on any of them.
And one figure on this list was not a skill at all. "Playwright, 88k" almost certainly refers to Microsoft's Playwright testing framework, not to any Claude skill wrapping it. The skills that do wrap it are small, and there are several. A framework's popularity had been silently transferred to a skill that borrows its name — which is a more useful warning than any star count: check what you are actually installing, not what it is named after.
Read that list again with the permission question in mind. Playwright opens a browser and drives your application. That is a fundamentally different ask from a skill that only shapes text output — and the star count tells you nothing about whether it should have it.
Popularity is a measure of how many people installed it, not of how many read it first.
A correction, made while fact-checking this page. An earlier version of this section said Huashu-Design carried "MIT with a commercial-use condition" and drew a conclusion from it. That was wrong, and it was wrong in an instructive way.
The screenshot it came from showed MIT* with an asterisk and a commercial-licence note. That was the licence until 14 May 2026, when the project moved to plain MIT — commercial use free, no prior authorisation, no fee.alchaincyf/huashu-design README and LICENSE, checked 22 Aug 2026
So the caution stands, but the example inverts: the licence I was warning about had already been fixed three months earlier. A licence read from a screenshot is a licence at whatever date that screenshot was taken — and licences change in both directions.
What to check before installing one
- Read it. All of it. A skill is text — usually short. If it is too long to read, that is itself the finding.
- Does it reference anything outside itself? A URL it fetches, a file it reads, an endpoint it posts to. Each is a channel out.
- Does it ask for permissions the task does not need? A formatting skill needing network access is the clearest signal there is.
- Does it contain instructions about instructions? "Ignore previous", "always", "regardless of" — language aimed at the agent's obedience rather than the task.
- Who publishes it, and does the account have history? A skill published last week by an account with nothing else is not a package with a maintainer.
A malicious library has to execute. A malicious skill only has to be read.
What the ecosystem does not have
Worth naming plainly, because the absence is easy to miss when installation is one click:
- No lockfile. A skill can change under you between runs.
- No signature. Nothing proves the author is who the listing says.
- No advisory database. When a skill is found malicious, there is no channel that tells you.
- No dependency graph. A skill invoking another skill is invisible until it happens.
npm took roughly a decade to build those. Skills are at year one and moving faster.
The working rule
Treat a skill as you would a script from a stranger, because that is exactly what it is. Read it, run it at tier one first, and check what it did against what it claimed.
And pin the ones you rely on. A skill you have read is a skill you have read at one version — nothing guarantees the next one is the same.