In the wild
ToxicSkills: 1,467 flawed and 76 confirmed-malicious agent skills across ClawHub and skills.sh
AIR-2026-0033 AIR record · 2026-02-snyk-toxicskills
From the supporting source
The barrier to publishing a new agent skill on ClawHub? A `SKILL.md` Markdown file and a GitHub account that's one week old. No code signing. No security review.snyk.io
The record
Disclosed
2026-02-05
Vendor
multiple
Product
ClawHub and skills.sh agent-skill registries
Risk domain
Access control and permissions › Credential theft
Also touches
Privilege escalation, Supply chain vulnerabilities, Data exfiltration channels
System type
Generative model
Who acted
Agent acted (contested) — the agents executed the malicious skills' shell payloads
Attack surface
Skill / plugin
Autonomy level
Semi-autonomous
Initial vector
Malicious marketplace package
Impact type
Credential theft, Backdoor installation, Data exfiltration, Persistence
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0012 – Valid Accounts
- NIST AI RMF
- MEASURE 2.7
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool failure
- Mitigation
- Use secure credential storage; Implement short-lived tokens.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
3,984 skills scanned; 36.82% (1,467) with at least one security flaw, 13.4% (534) critical; 8 malicious skills still live at publication
Capability abused
Defense & remediation
Recorded defense
none - publishing requires only a SKILL.md and a one-week-old GitHub account
Guardrail kinds
None
Guardrail outcome
Not applicable
Fix shipped
reported to marketplace operators; Snyk released scanning guidance
Taxonomy & references
Curator notes
Snyk Labs (Beurer-Kellner, Kudrinskii, Milanta, Bonde Nielsen, Sarkar, Tal). Named malicious publishers: zaycv (clawhud, clawhub1), Aslaep123 (polymarket-traiding-bot, base-agent, bybit-agent), pepe276 (moltbookagent, publish-dist), moonshine-100rze (moltbook-lm8). 91% of confirmed malicious skills combined conventional malware with prompt injection. Also reported as: 'ToxicSkills: Snyk audit of 3,984 agent skills on ClawHub and skills.sh finds 76 confirmed malicious payloads'.
Supporting sources
Cite as
Enkrypt AI. "ToxicSkills: 1,467 flawed and 76 confirmed-malicious agent skills across ClawHub and skills.sh". AIR, AIR-2026-0033. https://agentincident.vercel.app/i/AIR-2026-0033/ (accessed 2026-10-19).