Towards Secure Agent Skills: Architecture, Threat Taxonomy, and Security Analysis

Zhiyuan Li; Jingzheng Wu; Xiang Ling; Xing Cui; Tianyue Luo

cs.CRApr 3, 2026

Towards Secure Agent Skills: Architecture, Threat Taxonomy, and Security Analysis

Authors: Zhiyuan Li, Jingzheng Wu, Xiang Ling, Xing Cui, Tianyue Luo

Organizations: Institute of Software, Chinese Academy of Sciences, Beijing, China · University of Chinese Academy of Sciences, Beijing, China · Key Laboratory of System Software (Chinese Academy of Sciences), Beijing, China

Abstract

Agent Skills is an emerging open standard that defines a modular, filesystem-based packaging format enabling LLM-based agents to acquire domain-specific expertise on demand. Despite rapid adoption across multiple agentic platforms and the emergence of large community marketplaces, the security properties of Agent Skills have not been systematically studied. This paper presents a systematization of the security of the Agent Skills framework. We define a threat model for the framework and decompose the full lifecycle of an Agent Skill across four phases---Creation, Distribution, Deployment, and Execution---identifying the structural attack surface each phase introduces. Building on this lifecycle analysis, we construct a threat taxonomy comprising seven categories and nineteen scenarios organized across three attack layers, grounded in both architectural analysis and real-world evidence. Each scenario is annotated with whether the exposure follows from the specification or from the latitude the specification leaves to individual runtimes, with the strength of the public evidence supporting it, and with the feasibility of its mitigation. We map seven documented security incidents onto the taxonomy. Based on these findings, we discuss defense directions for each threat category, identify open research challenges, and provide actionable recommendations for stakeholders. The most severe threats arise from structural properties of the framework itself: the absence of a data-instruction boundary, a single-approval persistent trust model, and a capability declaration mechanism to which the specification attaches no enforcement semantics. None of these is addressable through incremental mitigations alone.

Figures & tables

Dimension	Description	ChatGPT Plugins	MCP	Agent Skills
Specification-Determined Properties
Instruction Carrier	Format used to convey the capability specification to the agent	✔	▲	✘
Data/Instruction Boundary	Whether instructions and runtime data are structurally separated	✔	▲	✘✘
Capability Declaration	Whether a capability must declare the resources it accesses, and whether that declaration binds	✔	▲	✘
Trust Model	Granularity and persistence of the authority granted when a capability is enabled	✔	✘	✘✘
Implementation-Determined Properties

Table 1. Comparison of agent capability extension mechanisms across security-relevant dimensions.

Panel of Table 2 — Table 2. Representative structure of a SKILL.md file.

Figure 1. The Agent Skills architecture. Left: the filesystem layout of a Skill package within the agent’s virtual machine, comprising SKILL.md , supplementary instruction files, and executable scripts. Right: the three-level progressive disclosure process, showing how Skill metadata (

m_{i}

), instructions (

\mathit{inst}_{i}

), and supplementary files (

f_{i,j}

) are loaded into the context window incrementally across Levels 1, 2, and 3 . The Agent Skills architecture. Left: the filesystem layout of a Skill package within the agent's virtual machine, comprising SKILL.md, supplementary instruction files, and executable scripts. Right: the three-level progressive disclosure process, showing how Skill metadata (

m_i

), instructions (

\mathit{inst}_i

), and supplementary files (

f_{i,j}

) are loaded into the context window incrementally across Levels 1, 2, and 3.

Figure 2. The Agent Skills lifecycle and threat taxonomy. The horizontal axis represents the four lifecycle phases. The vertical axis organizes threats into three attack layers. Scenarios that Table 3 maps to two phases are placed here at the earlier of the two, the phase in which they originate. Empty cells indicate that no threat in that layer originates at that phase. The Agent Skills lifecycle and threat taxonomy. The horizontal axis represents the four lifecycle phases. The vertical axis organizes threats into three attack layers. Scenarios that Table~\ref{tab:taxonomy} maps to two phases are placed here at the earlier of the two, the phase in which they originate. Empty cells indicate that no threat in that layer originates at that phase.

ID	Scenario	Description	Ph	Or	Ev	Fe
Layer 1: Delivery and Trust Establishment
T1: Supply Chain Compromise
T1.1	Typosquatting	Malicious Skill registered under a name resembling a popular legitimate Skill to deceive users into installation	Di	Ec	M	I
T1.2	Ranking Manipulation	Attacker inflates download counts and ratings to position a malicious Skill above legitimate alternatives	Di	Ec	M	I
T1.3	Repository Hijacking	Attacker gains control of a legitimate Skill repository through account takeover	Di	Ec	D	I
T1.4	Hallucinated Package	Skill references packages that do not exist, which attackers later claim on public registries to achieve code execution	Cr/Di	Ec	D	I

Table 3. Threat taxonomy for Agent Skills. Ph gives the lifecycle phase of origin: Cr = Creation, Di = Distribution, De = Deployment, Ex = Execution. Or gives the origin of the exposure: Sp = specification, Im = implementation latitude, Ec = ecosystem distribution. Ev gives the strength of the public evidence: M = multiple independent measurements or campaigns, D = a single documented incident or demonstration, A = architectural inference with no public instance. Fe gives the mitigation feasibility: I = incremental, deployable without specification change, S = requires a specification change, O = open problem.

Incident	Mapping	Key Impact
MedusaLocker Skill	T4.1, T2.1	Ransomware executed via bundled script, consent gap exploited
ClawHavoc Campaign	T1.1, T1.2, T5.1	At least 1,184 malicious Skills, credential theft at ecosystem scale
CVE-2025-59536 / CVE-2026-21852	T6.2, T5.1	Command execution and API key exfiltration via configuration injection
SafeDep PEP 723	T4.2	Deferred dependency attack via unpinned script dependencies
Mitiga Silent Egress	T5.3, T1.2	Project codebase exfiltrated in four user interactions, audit log empty
Zenity Skill Supply Chain	T1.1, T1.2, T1.5, T5.1	1.7 million installations, developer and CI credentials harvested, copies persisted after takedown

Table 4. Documented Agent Skills security incidents and their taxonomy mappings.

Figure 3. The MedusaLocker Ransomware attack. The user-visible layer shows normal GIF creation behavior, while the invisible execution layer downloads and executes MedusaLocker ransomware through the bundled helper script. The MedusaLocker Ransomware attack. The user-visible layer shows normal GIF creation behavior, while the invisible execution layer downloads and executes MedusaLocker ransomware through the bundled helper script.

Dimension	Hou et al. (MCP) ( Hou et al., 2025 )	Xu and Yan ( Xu and Yan, 2026 )	OWASP Skills ( OWASP GenAI Security Project, 2026 )	Ours
Threat Categories
T1 Supply chain compromise	⚫	⚫	⚫	⚫
T2 Consent abuse	◗	◗	◗	⚫
T3 Prompt injection	⚫	⚫	⚫	⚫
T4 Code execution	◗	⚫	⚫	⚫
T5 Data exfiltration	⚫	⚫	⚫	⚫

Table 5. Coverage of our threat categories by the closest prior and concurrent systematizations. ⚫ treated as a distinct category with an identified cause; ◗ mentioned or covered in part; ❍ not addressed.

Appendix figures & tables3 assets

Supplementary material from the paper’s appendix.

Appendix

Mechanism	Level	Basis
Instruction Carrier
ChatGPT Plugins	✔	The capability is conveyed as an OpenAPI manifest. The document is machine-parseable and enumerates endpoints with typed parameters, so an author cannot express behavioral directives outside the schema ( OpenAI, 2023 ) .
MCP	▲	Tools, resources, and prompts are declared with structured schemas, but the human-readable description fields accompanying each tool are model-facing prose and are read by the model when selecting operations ( Hou et al., 2025 ) .
Agent Skills	✘	The instructions body of SKILL.md is unstructured Markdown interpreted directly by the model. The specification imposes no schema on its content ( Agent Skills, 2025 ; Anthropic, 2025a ) .
Data/Instruction Boundary
ChatGPT Plugins	✔	The manifest and the API response are distinct artifacts. Response payloads return to the model within a typed envelope and cannot alter the set of operations the model may invoke ( OpenAI, 2023 ) .

Appendix

Table 6. Per-cell evidence for specification-determined properties.

Mechanism	Level	Basis
Execution Locus
ChatGPT Plugins	✔	Execution occurs on the provider’s infrastructure. No plugin code runs on the user’s machine ( OpenAI, 2023 ) .
MCP	▲ – ✘	Servers may be reached over HTTP, in which case execution is remote, or launched over stdio, in which case the server runs as a local user process ( Hou et al., 2025 ) .
Agent Skills	▲ – ✘	Skills execute within a managed environment on the Claude API and on the user’s host under Claude Code ( Pluto Security, 2026 ) .
Runtime Isolation
ChatGPT Plugins	✔	Isolation follows from the execution locus. The user’s machine is not a target of plugin code ( OpenAI, 2023 ) .

Appendix

Table 7. Per-cell evidence for implementation-determined properties.

Mechanism	Level	Basis
Marketplace Review
ChatGPT Plugins	✔	Publication in the plugin store required passing a review process combining automated and human checks ( CustomGPT, 2023 ) .
MCP	✘	Distribution is decentralized. Servers are installed directly from source repositories, and no review gate stands between publication and installation ( Hou et al., 2025 ) .
Agent Skills	✘	The major community marketplaces impose no mandatory review before publication ( Snyk Security Research, 2026 ) . Curated registries that scan and sign Skills have since appeared ( NVIDIA, 2026 ) , but they are additional channels rather than a requirement of the ecosystem.

Appendix

Table 8. Per-cell evidence for distribution and ecosystem governance.

LLM Agent Security

Large language model agent security studies attacks and safeguards for systems that plan, use tools, retain memory, and act across applications.

See all 327 papers

Context Matters: Repository-Aware Security Analysis of the Agent Skill Ecosystem
Mar 17, 2026Florian Holzbauer, David Schmidt, Gabriel Gegenhuber +2AI Agent Security Agent Skill Security Auditing
Interdisciplinary Transformation University (IT:U), Linz, Austria · University of Vienna, CDL AsTra, Faculty of Computer Science, Vienna, Austria
SoK: Agentic Skills -- Beyond Tool Use in LLM Agents
Feb 24, 2026Yanna Jiang, Delong Li, Haiyu Deng +4Agentic AI LLM Agent Skill Learning
University of Technology Sydney · CSIRO Data61
Benign in Isolation, Harmful in Composition: Security Risks in Agent Skill Ecosystems
Jun 13, 2026Yi Xie, Jiawei Du, Yu Cheng +2LLM Agent Security AI Agent Security Benchmarks
East China Normal University, Shanghai, China · Centre for Frontier AI Research A*STAR, Singapore · Shanghai Innovation Institute, Shanghai, China

Mar 17, 2026J/K move · Enter open · S save

Context Matters: Repository-Aware Security Analysis of the Agent Skill Ecosystem

Florian Holzbauer, David Schmidt, Gabriel Gegenhuber, Sebastian Schrittwieser+1

Interdisciplinary Transformation University (IT:U), Linz, Austria · University of Vienna, CDL AsTra, Faculty of Computer Science, Vienna, Austria

AI Agent Security Agent Skill Security Auditing Software Supply Chain Security

Open paper AskPDF arXiv

Agent skills extend local AI agents, such as Claude Code and OpenClaw, with additional functionality. Their growing popularity has led to dedicated marketplaces resembling mobile app stores, as well as automated scanners that assess whether skills are benign or malicious. However, scanner reports from individual marketplaces classify up to 46.8% of skills as malicious, raising concerns about false positives. We present the largest empirical security analysis of the AI agent skill ecosystem to date. We collect 238,180 unique skills from three major distribution platforms and GitHub, and analyze their contents, behavior, and repository context. Unlike existing scanner-based assessments, which evaluate skills largely in isolation, our repository-aware analysis checks whether a flagged skill is consistent with its surrounding GitHub project. This context substantially reduces the number of suspicious skills: only 0.52% remain suspicious after repository-aware analysis. Our results show that existing scanners can substantially overestimate maliciousness when repository context is ignored. At the same time, we identify previously undocumented real-world attack vectors, including the hijacking of skills hosted in abandoned GitHub repositories. Overall, our findings provide a more robust view of the agent-skill ecosystem's current risk surface and highlight the need for context-aware security evaluation.

Abstract

LLM Agent Security

Explore similar work

Context Matters: Repository-Aware Security Analysis of the Agent Skill Ecosystem

SoK: Agentic Skills -- Beyond Tool Use in LLM Agents

Benign in Isolation, Harmful in Composition: Security Risks in Agent Skill Ecosystems