{
  "entry": {
    "kind": "vuln",
    "slug": "toxicskills-36-percent-of-audited-agent-skills-carried-security-flaws",
    "name": "toxicskills-36-percent-of-audited-agent-skills-carried-security-flaws",
    "vendor": "36 Percent of Audited Agent Skills Carried Security",
    "description": "Snyk audited 3,984 agent skills across the ClawHub and skills.sh marketplaces and found 1,467 of them, 36 percent, carrying security flaws, 534 of those rated critical. Seventy-six confirmed malicious payloads were identified, and 91 percent of the malicious skills used prompt injection to do their work. Eight were still live on ClawHub when the research published, affecting OpenClaw, Claude Code and Cursor users. The number that matters for governance is the base rate: this is not a handful of bad uploads to take down, it is a marketplace where roughly a third of the catalogue fails review.",
    "website": "https://snyk.io/blog/toxicskills-malicious-ai-agent-skills-clawhub/",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "skill",
    "updatedAt": "2026-02-05",
    "risk": {
      "score": 75,
      "band": "high",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "toxicskills-36-percent-of-audited-agent-skills-carried-security-flaws",
      "aliases": [
        "ti-085"
      ],
      "title": "ToxicSkills: 36 Percent of Audited Agent Skills Carried Security Flaws, and 8 Malicious Ones Were Still Live",
      "summary": "Snyk audited 3,984 agent skills across the ClawHub and skills.sh marketplaces and found 1,467 of them, 36 percent, carrying security flaws, 534 of those rated critical. Seventy-six confirmed malicious payloads were identified, and 91 percent of the malicious skills used prompt injection to do their work. Eight were still live on ClawHub when the research published, affecting OpenClaw, Claude Code and Cursor users. The number that matters for governance is the base rate: this is not a handful of bad uploads to take down, it is a marketplace where roughly a third of the catalogue fails review.",
      "severity": "high",
      "cvss": {
        "score": null,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Prompt injection",
        "Supply chain compromise"
      ],
      "componentType": "skill",
      "component": {
        "name": "36 Percent of Audited Agent Skills Carried Security",
        "vendor": null,
        "package": null,
        "ecosystem": null,
        "catalogSlug": null
      },
      "affected": [
        {
          "range": "3,984 skills audited across ClawHub and skills.sh: 1,467 flawed, 534 critical, 76 confirmed malicious payloads",
          "fixed": null
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-02-05",
      "modifiedAt": "2026-02-05",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://snyk.io/blog/toxicskills-malicious-ai-agent-skills-clawhub/"
        }
      ],
      "mitigation": "Audit the skills already sitting on developer machines rather than only gating new installs, and rotate API keys and cloud credentials any installed skill could reach. Check agent memory files for unauthorized edits too, since a malicious skill that already ran may have left instructions behind. At a one-in-three flaw rate an allowlist of reviewed skills is the workable control; a blocklist of known-bad ones is not.",
      "detectedByAnomity": true
    }
  }
}