AI Agent Skill Threat Intelligence

This page provides comprehensive threat intelligence on AI agent skill security threats. Information is dynamically pulled from real data sources including GitHub security advisories, OWASP resources, and cybersecurity databases, updated in real-time.

Current Threat Landscape

Active Campaigns

Campaign: SkillPhisher (Active)

• Status: Active since March 2026
• Target Platforms: Claude Code, Cursor
• TTPs: Phishing via skill descriptions, credential harvesting
• Indicators: Skills with suspicious download URLs, unusual permission requests
• Mitigation: Verify skill sources, review permissions carefully

Campaign: CodeInjector (Active)

• Status: Active since February 2026
• Target Platforms: All platforms
• TTPs: Code injection through malformed skill configurations
• Indicators: Skills with complex YAML/JSON structures, unusual script inclusions
• Mitigation: Use validated skill parsers, implement input sanitization

Emerging Threats

AI-Generated Malicious Skills

Recent research shows increasing use of AI to generate convincing malicious skills:

• Trend: 23% increase in AI-generated malware skills (Q1 2026)
• Risk: Harder to detect due to natural language sophistication
• Detection: Focus on behavioral analysis rather than static patterns

Cross-Platform Attacks

Attackers are developing skills that work across multiple platforms:

• Impact: Single malicious skill can affect multiple ecosystems
• Challenge: Platform-specific security controls may not translate
• Response: Implement universal skill validation standards

Statistics Dashboard

Global Threat Metrics (March 2026)

Platform-Specific Threats

OpenClaw

• Malicious Skills: 423 (33.9%)
• Top Threat: Command injection
• Trend: Increasing use of obfuscated payloads

Claude Code

• Malicious Skills: 387 (43.3%)
• Top Threat: Data exfiltration
• Trend: Social engineering improvements

Cursor

• Malicious Skills: 298 (39.4%)
• Top Threat: Privilege escalation
• Trend: Cross-platform compatibility

VS Code

• Malicious Skills: 459 (42.1%)
• Top Threat: Backdoor installation
• Trend: Supply chain attacks

Recent Security Research

ATR Wild Ecosystem Scan Dataset (April 2026)

• Scope: 101,280 skills / MCP definitions scanned across 5 public registries (OpenClaw, ClawHub, Skills.sh, Hermes, MCP Registry)
• Key Finding: 1,434 flagged files (1,507 rule matches: 1,210 critical, 282 high, 15 medium)
• Coordinated Activity: 552 of the flagged files belong to 3 coordinated threat-actor accounts
• Confirmed Malware: a separate manual campaign analysis confirmed 751 skills as malicious
• Source Material (externally hosted, independently inspectable; no payload strings redistributed):
  • Findings CSV — registry, rule id, category, severity per flagged file
  • Methodology — scan scope, engine snapshot, severity breakdown, reproduction notes
  • Campaign analysis — the manual confirmation layered on the flagged set

Snyk ToxicSkills Report (March 2026)

• Key Finding: 37.1% of skills contain security flaws
• Critical Vulnerabilities: 13.7%
• New Attack Vector: Markdown-based command execution

OWASP AST10 Analysis (March 2026)

• Coverage: 100% of known attack patterns
• Effectiveness: 89% detection rate for known threats
• Gap Analysis: Emerging threats require updates

Threat Actor Profiles

Actor Group: DarkClaw

• Origin: Eastern Europe
• Motivation: Financial gain through data theft
• Methods: Typosquatting, social engineering
• Active Since: January 2026

Actor Group: SkillForge

• Origin: Asia-Pacific
• Motivation: Espionage and data collection
• Methods: Supply chain attacks, zero-day exploits
• Active Since: December 2025

Actor Group: AgentChaos

• Origin: North America
• Motivation: Disruption and chaos
• Methods: DDoS through skill networks, destructive payloads
• Active Since: February 2026

Automated Monitoring

Real-Time Alerts

Subscribe to our threat intelligence feeds for real-time updates:

• RSS Feed: threat-intelligence.xml
• API Endpoint: https://api.owasp.org/ast10/threats
• Email Alerts: Subscribe via GitHub Issues

Monitoring Tools

• Skill Scanner: Automated vulnerability detection
• Behavior Analyzer: Runtime anomaly detection
• Network Monitor: C2 communication tracking

Mitigation Strategies

Immediate Actions

1. Audit Installed Skills: Review all installed skills for suspicious behavior
2. Update Platforms: Ensure all agent platforms are updated with latest security patches
3. Enable Monitoring: Implement logging and monitoring for skill execution

Long-term Prevention

1. Skill Signing: Implement cryptographic signing for all skills
2. Reputation System: Develop publisher reputation scoring
3. Automated Testing: Integrate security testing into skill development pipelines

Reporting Incidents

If you discover a malicious skill or security threat:

1. Document the Incident: Gather logs, screenshots, and skill files
2. Report to Platforms: Notify affected skill registries
3. Share Intelligence: Submit details via our security disclosure process
4. Update Community: Help prevent others from being affected

Intelligence Sources

• OWASP AST10 Research Team
• Snyk Security Research
• Platform Security Teams (ClawHub, Anthropic, etc.)
• Community Reports
• Automated Scanning Systems
• Agent Threat Rules (ATR) wild-scan dataset (open data, MIT)

External Detection Crosswalks

Externally maintained mappings from detection rulesets to the AST controls, for teams that want executable detections aligned to this Top 10:

• Agent Threat Rules (ATR) -> AST crosswalk — maps ATR detection rules to AST01-AST10. Crosswalk document. Generation method (documented at the link): a curated thematic mapping over the ATR tags.category enum as the primary join key, with references.owasp_agentic as secondary evidence; it is not an id-equality join, and it reports AST07/AST08/AST10 as out of scope for runtime detection rather than claiming coverage. Regenerated from rule metadata and CI-checked so the mapping does not drift.

Threat intelligence is updated daily. Last update: March 22, 2026