Toxic skills
Also known as: ToxicSkills, malicious agent skills, poisoned skills
A toxic skill is an agent skill that looks legitimate but carries hidden malicious behavior: a prompt injection payload that hijacks the agent's next action, malware that runs when the skill executes, hardcoded API keys that exfiltrate credentials, or fetch-and-execute patterns that pull down more dangerous code after installation. Snyk coined the term 'ToxicSkills' in early 2026 after completing the first large-scale audit of the agent skills supply chain, scanning nearly 4,000 skills from ClawHub and skills.sh.
The risk is higher than in traditional software package ecosystems because agent skills run inside a running agent session. A malicious npm package might compromise a build. A malicious agent skill can redirect the agent's reasoning mid-task, steal credentials the agent is currently using, or execute shell commands with the same permissions the agent holds. The attack surface grows with agent capability: a coding agent with file-system access and shell permissions is a much more valuable target than a simple chatbot plugin.
Defenses are still maturing. ClawHub added VirusTotal scanning after the 2026 incidents. Builders can reduce exposure by checking skill source code and dependencies before installing, pinning skill versions rather than always pulling the latest, running agents in minimal-permission sandboxes, and treating third-party skills with the same skepticism you would apply to a random npm package from a developer you don't know.