AST01: Malicious Skills
Risk Level: Critical
A skill that looks legitimate in the registry listing and does something else once installed. The payload is usually a credential stealer, a reverse shell, or instructions written in plain prose that tell the agent to read a file and send its contents somewhere. Because a skill is a bundle of instructions rather than a compiled binary, the malicious part can be a paragraph of English that no code scanner flags.
Real-world evidence
The AST10 project cites the ClawHavoc campaign, which began January 27, 2026 and published 341 malicious skills to the ClawHub registry in its first three days. Antiy CERT's February 2026 tally put the final total at 1,184 malicious skills across 12 publisher accounts. At peak infection, five of the seven most-downloaded skills on the registry were confirmed malware. A separate Snyk review (ToxicSkills) scanned 3,984 skills and identified 76 confirmed malicious payloads.
Why registries make it worse
Download count reads as a trust signal, and on a poisoned registry it is the opposite: the campaign optimized for installs. A skill with thousands of downloads and a clean description is exactly what a targeted campaign produces.
Mitigations
- Require cryptographic signatures (ed25519) on published skills, and verify them at install time
- Scan at both publish time and install time, using behavioral analysis rather than signature matching alone
- Hash-pin installed skills and alert when an installed skill's content changes
- Treat publisher trust level and scan status as install-gating data, not decoration in the registry UI
- Read the skill's instructions, not just its code, before installing anything that touches credentials