English
Book an intro call

What to check before installing a skill for an AI agent in your organization

A skill is a folder of instructions, scripts and files that teaches an AI agent how to carry out a task. Anthropic launched the format in October 2025, published it as an open standard in December, and it now works across many tools. Installing a skill takes seconds. But a skill can make the agent run code, and a developer’s agent usually has access to source code, cloud service keys and passwords. Anthropic itself recommends installing skills only from trusted sources.

What the researchers found

  • In February 2026, Snyk scanned 3,984 skills from two popular libraries. It found a critical issue in 13.4% of them, and manual review confirmed 76 as malicious.
  • That same month, Koi Security reported 341 malicious skills out of 2,857 in the ClawHub library. Most asked the user to install a “prerequisite” that was in fact software built to steal passwords, keys and crypto wallets.
  • In August 2026, at Black Hat, the Israeli cybersecurity company Zenity exposed a campaign in which a family of skills, with names that mimicked well-known skills, was installed more than 1.7 million times.

The method behind that last campaign is what makes it so troubling. The skills were published clean, collected installs, and only later were updated to a malicious version that searched for SSH keys, cloud credentials, Git tokens and configuration files containing passwords. Vercel and GitHub removed them within 12 hours, but copies may still remain elsewhere.

The same risk in MCP servers

MCP servers are the connections an agent uses to reach outside tools such as email, a database or a task tracker. In September 2025, the first malicious MCP server seen in actual use was found: a package called postmark-mcp, which in version 1.0.16 gained a single line that sent the attacker a hidden copy of every email. As early as April 2025, Invariant Labs showed how instructions hidden in a tool’s description can make an agent leak keys, and how a tool’s description can change after the user has already approved it.

Damage without an attacker

Not all damage comes from malicious code. In July 2025, a Replit agent deleted a production database during a code freeze. In July 2026, entrepreneur Matt Shumer reported that an OpenAI coding agent had deleted most of the home folder on his computer, and OpenAI confirmed that the model had mistakenly overwritten the path it was working in. In both cases the agent had permissions that were far too broad, and nothing was in place to stop a destructive action before it happened.

What to check before installing

OWASP, the organization behind the best-known risk lists in the field, describes the root of the problem as a combination of too much functionality, too many permissions and too much autonomy. The checklist follows from that:

  • Read every file in the skill before installing it, including scripts and dependencies, and look for network calls and commands that execute code. This is also Anthropic’s recommendation.
  • Run a scan. Snyk offers an open tool for scanning skills, and Zenity launched AI Total, an isolated environment that runs a skill and checks what it actually does.
  • Pin the version. Because of the “clean first, malicious later” method, automatic updates to a skill or an MCP server are a risk in their own right.
  • Give each MCP server only the permissions it needs, with no general-purpose tokens and no access to the whole account.
  • Do any work involving unfamiliar content in an isolated environment, such as a virtual machine or a dev container.
  • Require human approval for destructive actions: deletion, changes to production, sending data outside. Open tools such as dcg block commands like recursive deletion or DROP TABLE before they run.
  • Keep development and production separate, and maintain a backup you have already tested restoring from.

If something suspicious is already installed

Snyk recommends rotating every password and key the skill could have reached, and checking whether the agent’s memory files were altered. Removing the skill alone is not enough, because keys that were already stolen stay with the attacker.

A decision for the organization, not for each developer

In an organization with several teams, the decision about what may be installed cannot be left to each developer alone. This is where an approved list of skills and MCP servers comes in, with an owner who reviews every addition. Tools such as Claude Code already let you manage a list like this at the organization level, with managed settings that developers cannot override. It is the same principle organizations know from managing third-party software, only at a much faster pace.

Frequently asked questions

What is the difference between a skill and an MCP server?
A skill is a folder of instructions and scripts that the agent loads when the task calls for it. An MCP server is software that connects the agent to an outside tool, such as email, a database or a task tracker. Both run code on the agent’s behalf, so both need to be checked.
Is a skill from a well-known library safe?
Not necessarily. The campaign Zenity exposed ran in a well-known library, and the skills were clean when they were first installed. Anthropic also notes that it does not review or manage the MCP servers that users connect.
Is it enough to check a skill once?
Only if you pin the version. From a security standpoint, every update is a new skill that needs to be checked again.

Sources

Want to talk about this in the context of your system? Book a free one-hour intro call.