Snyk

Stop Asking If an AI Skill Is Safe — Ask What It Can Do Instead

A detailed analysis warns that AI agent skills distributed as simple text files can execute malicious commands with full user privileges. The article examines how prompt injection attacks embedded in skill.md files have already led to credential theft and persistent malware that survives system restores. Research by Snyk on 3984 public skills found that 36.8 percent contained at least one security issue and 13.4 percent had critical flaws. The author argues that traditional security badges are ineffective because skills can dynamically load payloads, target reviewers with injection, or change after initial review. Instead, a new tiered system called skill-xray classifies capabilities from inert text (T0) to runtime code loading (T4) and binds results to content hashes. The approach is implemented in an open-source MIT-licensed tool that combines static regex scanning with agent-based reporting to surface risks without issuing false safety guarantees.

Stop Asking If AI Agent Skills Are Safe — Focus on Capability Disclosure Instead

A new approach called capability disclosure is proposed for evaluating skills used by AI agents, replacing unreliable safety badges. The shift comes after documented cases where malicious SKILL.md files survived system reinstalls through backups and executed data theft via prompt injection. Snyk's ToxicSkills analysis of 3984 public skills found 36.8% with security issues and 13.4% critical, including 76 confirmed malicious payloads. The skill-xray tool provides structural scanning and tiered reporting from T0 (inert text) to T4 (opaque runtime code loading) without issuing safety verdicts. Real-world examples include CVE-2025-6514 affecting mcp-remote with over 437,000 installations. The method emphasizes revealing what a skill can access rather than promising it is harmless.