Tens of thousands of agent skills now sit in public registries, and independent scans show a measurable share contain at least one critical security issue. The small reusable packages, built around a SKILL.md file, are already speeding real work: one data scientist used two skills to turn an eight-year weekly visualisation ritual into an end-to-end automated workflow that ran in minutes inside Codex Desktop. Vendors including Anthropic and Google have published design notes and examples, but academics and firms such as Snyk and RELAI.ai warn the same modular, metadata-first design that powers flexibility also opens new semantic supply-chain attack vectors. Practitioners are weighing real productivity gains against registry-level risks.

Agent skills are a compact way to package tasks so an AI agent can reuse them on demand. At their simplest a skill is a SKILL.md file that records a name, a description and detailed step-by-step instructions. Implementations typically use a metadata-first approach, letting an agent load just enough context to decide whether to fetch the rest of the package. Vendor writeups call this progressive metadata disclosure. The idea is practical: keep the model's main prompt short and defer heavier resources until they're needed, which reduces context bloat and helps multi-step workflows run more predictably.

From weekly chores to minutes

The productivity case is already concrete for some data scientists. Yu Dong showed how two reusable skills can automate a routine he had done weekly for eight years. Dong's storytelling-viz skill analyses a dataset, surfaces insights, recommends chart types and generates an interactive visualisation. A separate viz-publish skill embeds the output on his website.

Dong triggered the storytelling-viz skill from Codex Desktop after querying an Apple Health dataset in Google BigQuery. The combined process ran end-to-end in under 10 minutes, compared with roughly one hour for his manual routine. The automated run produced an insight-led headline, an interactive chart, explicit caveats and a data source note. That case shows what modular skills do best: codify repeatable judgement and assembly tasks so an agent can run them reliably without rebuilding context from scratch each time.

Adoption and tooling are moving fast. Public directories such as skills.sh host large collections of skills, and one account of the ecosystem reports more than 77,000 skills cataloged in Versel's skills.sh directory. Vendors including Anthropic and Google have circulated design notes and examples that show how skills can be loaded, shared from Git repositories and composed into larger agent workflows. Several vendor writeups also stress that any bundled code should run in secure sandboxes.

Mastheads

That combination of rapid adoption and modular sharing is the capability that security researchers say needs careful scrutiny. Soheil Feizi, a computer science professor at the University of Maryland and founder and CEO of RELAI.ai, has warned that many agent frameworks allow users to install skills from online registries so an agent can discover and use new capabilities on demand.

That behaviour creates a new attack surface where text and metadata can be as influential as executable code.

Feizi and co-authors have posted a preprint titled "Under the Hood of SKILL.md: Semantic Supply-chain Attacks on AI Agent Skill Registry" that examines how adversarial skills get discovered, selected and vetted before execution. The paper digs into how small, semantic edits to descriptions or metadata can change how a registry ranks or surfaces a skill, and how those changes can alter an agent's decision to fetch and run a package.

Independent scanning by security firm Snyk gives concrete numbers. Snyk's study of ClawHub and skills.sh found that 13.4 percent of skills, about 534 out of 3,984 items in the sample, contained at least one critical-level security issue. The issues included malware distribution, prompt injection attacks and exposed secrets. Those findings show the risk isn't hypothetical: a measurable share of public items contain severe problems.

The operational behaviour of agents raises the stakes. Agents can automatically retrieve and load third-party skills if registry descriptions appear relevant to the task at hand. That means an attacker doesn't need to hide malware in compiled code to affect behaviour. Small changes to text, URLs or metadata can influence discovery, selection and governance checks. Indirect prompt injection can occur when an agent visits a web page and processes the page text as if it were part of its instruction set. In short, text is a vector, and registries are a choke point.

Vendors and some writeups already point toward mitigations. Design notes from Anthropic and Google show examples of how skills should be loaded and composed, and they recommend secure sandboxes for any bundled code. But sandboxing addresses only executable risk. The semantic supply-chain problem reaches into discovery, ranking and governance, where text and metadata shape automated decisions long before any code runs.

For data scientists the trade-off is immediate. Skills let teams capture routine judgement once and apply it many times. That's what saved Dong about 50 minutes on a weekly task and what registries promise at scale. At the same time the open registries that make sharing easy also make it possible for attackers to influence agents without touching traditional executables. Organisations building agent workflows must therefore treat registries and metadata as part of their security perimeter.

Related Articles

The most concrete takeaway is the Snyk scan: 13.4 percent of items in its ClawHub and skills.sh sample contained at least one critical-level security issue. Organisations building agent workflows should treat registries and metadata as part of their security perimeter.

This article was created with AI assistance.