AI Skills Are an Injection Path Too: Scanning 954 Popular Skills, and an Eighth Question Before Buying an AI System
Table of Contents
The short answer: the skills you install into your AI assistant can themselves be an injection path. A September 2026 paper scanned 954 popular skills. An automated tool flagged about one in six, and when 5 of them were attacked for real, 13 of 30 attempts succeeded. This matters most to anyone buying an "AI one-person-company system", because what those systems sell is a large bundle of skills.
Disclosure first: one of the scanners the paper compares against is NVIDIA's SkillSpector, and we have two merged PRs in that project. We also build prompt-defense scanning ourselves. Every number below follows the paper and official documentation, with the qualifiers attached.
What a skill is, and why it is a way in
A skill is a reusable bundle of instructions, scripts and configuration. Install one into an AI coding assistant such as Claude Code and it can do one more thing: sort invoices, write a weekly report, review a contract.
The problem is that a skill is both instructions and code. Anthropic's documentation says it plainly: skills give Claude new capabilities through instructions and code, so a malicious skill can direct Claude to invoke tools or execute code in ways that do not match the skill's stated purpose.
One more sentence matters even more: in Claude Code, skills have the same network access as any other program on your computer. Skills run through the API are sandboxed with no network access. The same skill can reach completely different things depending on whether it runs on your machine or in the cloud.
What the paper measured
SkillSecurer, by five authors at Politecnico di Torino, was submitted to arXiv on 12 September 2026.
They built an adversarial system: a red side plants nine kinds of injection into skills and records what it changed, and a blue side analyses the whole skill, finds problems and proposes patches. Then they pointed it at the real world.
| Item | Paper's figure | Qualifier |
|---|---|---|
| Real-world sample | 954 of the most popular skills with third-party scan records, from a 3 July 2026 snapshot of skills.sh | skills.sh is Vercel's skills directory |
| Flagged | 168 (17.6%), with 289 findings | This is the tool's flag rate, not a confirmed rate |
| Human review | Three reviewers examined 100 findings; a majority confirmed 84 | The authors judged them latent vulnerabilities, not deliberately planted injections |
| Live attacks | 5 skills, 13 successes in 30 model-skill combinations | The 5 skills are withheld pending coordinated disclosure |
| Re-attack after patching | Same 5 skills, 3 successes in 30 | Measures only these 5 skills |
| Patch review | Of 75 patch proposals for confirmed findings, 65 judged effective (86.7%) | A different population; the paper does not say whether it includes the 5 |
| Detection rate | 100% on 345 controlled samples | Holds only on controlled samples, with Claude Sonnet 5 as the backend |
The live attacks were ordinary: put malicious content into external input the skill already reads, such as a ticket, a pull request or a web page. The skill does its normal job, reads that content, and gets taken over.
The five attack mechanisms the paper tested need no special skill: exposing a logged-in browser session as an unauthenticated proxy, piping web content straight into a terminal, executing code from someone else's pull request, inserting unescaped request parameters into commands, and forwarding login credentials to a third party.
The sentence worth remembering
all models recognise the risks in Skills B and C, yet some still execute the corresponding attack.
Recognising danger is not the same as refusing it. Microsoft reached the same conclusion around the same time.
Microsoft: the model is not a security boundary
In May 2026 Microsoft's security blog disclosed two vulnerabilities in its own agent framework, Semantic Kernel:
| Vulnerability | Score | What happened | Fixed in |
|---|---|---|---|
| CVE-2026-25592 | 9.9 (GitHub rating) | A file-download function was accidentally exposed as a tool the model could call, with no path check | .NET 1.71.0; the GitHub advisory also lists the Python package, fixed in 1.39.3 |
| CVE-2026-26030 | 9.9 (GitHub rating) | A vector-store filter executed model-supplied parameters as code | Python 1.39.4 |
The attack chain Microsoft demonstrated takes two injected sentences: first have the agent generate a malicious script inside its isolated container, then have it use the download tool to write that script into the host's startup folder. At the next login, the whole host is compromised.
Microsoft's own conclusion:
your LLM is not a security boundary. The tools you expose define your attacker's affected scope.
The same class of problem has shown up in code editors: CVE-2026-22708. In Cursor's auto-run mode, some shell built-ins could run even though they were not on the allow list, so an attacker could use injection to change environment variables and influence otherwise trusted commands. It was fixed in version 2.3. The scores differ widely: NIST rates it 9.8 and GitHub 7.2, so say whose rating you are quoting.
All three have been patched, and public records show no exploitation in the wild.
Mapping to OWASP
In the OWASP Top 10 for Agentic Applications released in December 2025, this post touches four entries: ASI01 Agent Goal Hijack, ASI03 Identity and Privilege Abuse, ASI04 Agentic Supply Chain Vulnerabilities, and ASI05 Unexpected Code Execution. Among the paper's findings, the most common were ASI05 (96) and ASI01 (84).
The eighth question before buying an AI one-person-company system
We recently wrote seven questions to ask before buying an AI one-person-company system. What those systems actually are is a large bundle of skills, rules and scripts installed into your Claude Code or Codex, running on a computer with full network access.
So there is an eighth question: what can this bundle of skills touch?
Broken into five parts:
- Who wrote each skill? Can its origin be traced?
- Does it go online? Where to?
- Does it fetch content from external URLs, tickets or email and hand it to the model? (Every attack in the paper went this way.)
- Does it run scripts? Do any scripts pass external content straight into a terminal?
- Has it been scanned? With what tool, and will they show you the results?
Anthropic's own advice is to use only skills you wrote or that come from Anthropic, and to read every file of a third-party skill, watching for unexpected network calls and file access. Enterprise plans can turn on content scanning for uploaded custom skills, but the documentation also says skills uploaded through the API or Console are not covered.
Asking the eighth question of ourselves
The handbook we sell comes with a toolkit. We ran the five questions against it:
- No SKILL.md. The toolkit is scripts, hooks and templates, not skills.
- Four scripts go online. Two send alerts to your own Telegram bot. One uses curl to fetch a URL you choose and compare its content. One opens a headless browser at a URL you choose, fills the fields you give it and presses submit. That last one really does submit data, so run it only against your own test environment.
- None of them hand fetched content to a model as instructions. The curl script and the browser script only search the page for success or failure text.
- Two scripts are hooks. They do not install themselves; you add them to your project's
.claude/settings.json. Once wired in, they run every time Claude Code wraps up, with your local permissions. The purchase page did not make these points clear, and we added a permissions note while writing this post. - No third-party scan. This is the one we have not done.
What you can do
- Before using a skill, check which external inputs it reads. A skill that reads web pages, tickets or email wires strangers' text into your assistant.
- Anything that can run in a sandbox or through the API should not run on a machine with full network access.
- Take "the model will use its judgement" off your list of defences. The paper and Microsoft both show it can recognise the danger and comply anyway.
- If you are building an AI application that takes user input, UltraProbe's prompt-defense scan can check whether your system prompt has basic defences. It checks your application, not the skills you install.
Sources
- Mecca, Verna, Bouchari, Jha, Mellia, SkillSecurer, arXiv 2609.14079, 2026-09-12
- Microsoft Security Blog, When prompts become shells, 2026-05-07
- NVD: CVE-2026-25592, CVE-2026-26030, CVE-2026-22708; GitHub advisory GHSA-2ww3-72rp-wpp4
- Anthropic, Agent Skills documentation, Security considerations section
- OWASP, Top 10 for Agentic Applications, 2025-12-09
FAQ
What is an AI agent skill?
A reusable bundle of instructions, scripts and configuration that teaches an AI coding assistant such as Claude Code how to do one more thing. Anthropic's documentation says skills give Claude new capabilities through instructions and code, so a malicious skill can direct Claude to invoke tools or execute code in ways that do not match the skill's stated purpose.
Do 17% of popular skills really have vulnerabilities?
With qualifiers. The paper scanned 954 popular skills and its tool flagged 168, or 17.6%. Reviewers sampled only 100 of the findings, and a majority of three confirmed 84, judging them latent vulnerabilities rather than deliberately planted injections. The accurate statement is: an automated tool flagged about one in six, and about 84% of a reviewed sample was confirmed.
If a model recognises the danger, is it safe?
Not necessarily. The paper attacked 5 skills with latent vulnerabilities, and 13 of 30 model-skill combinations were successfully attacked. The authors note that every model recognised the risk in two of the skills, yet some still carried out the attack. After patching, 3 of 30 still succeeded.
What should I watch for when installing skills in Claude Code?
Anthropic recommends using only skills you wrote yourself or that come from Anthropic, and reviewing every file of third-party skills. Its documentation also says that in Claude Code, skills have the same network access as any other program on your computer, while skills run through the API are sandboxed with no network access. Skills that fetch content from external URLs are especially risky, because that content can carry instructions.
What extra question should I ask before buying an AI one-person-company system?
Ask where the skills come from and what they can touch: who wrote each skill, whether it goes online, whether it fetches external content and hands it to the model, whether it runs scripts, and whether it has been scanned. These systems are essentially large bundles of skills installed on a computer with full network access.