---
title: Snyk: >65% of top agent skills on skills.sh / ClawHub are vulnerable; 9 critical malicious skills (lookalike APIs, silent CLAUDE.md plant) | ctxsec
url: https://ctxsec.com/items/snyk-agent-skill-ecosystem-reassessment-skills-sh-clawhub-nov-6
description: "Snyk re-scanned the 10,000 most popular skills on skills.sh and on ClawHub (snapshot Oct 27). Headline: more than 65% of analyzed skills are vulnerable \u2014 unsafe behaviors that expose agents to sensitive systems, wallets, untrusted third-party content or hardcoded credentials \u2014 and the ecosystem remains a significant supply-chain risk. Overtly malicious skills are rarer but more sophisticated: Snyk's updated engine flagged 2 critical skills on skills.sh and 7 on ClawHub. Patterns include lookalike API endpoints that harvest keys (e.g. api-w3stream.attoaioz.cyou impersonating AIOZ Stream), an agents-md 'validator' that runs an opaque binary then silently appends attacker instructions to ~/.claude/CLAUDE.md, obfuscated code that forbids decompilation, and skills that append insults or enroll agents in external 'governance' under a curl diagnostic pretext."
status: "confirmed research (Snyk research blog, Nov 6); top 10k skills on skills.sh and ClawHub as of Oct 27 snapshot; critical=actively malicious per Snyk severity model"
published: 2026-11-06
---

> Snyk re-scanned the 10,000 most popular skills on skills.sh and on ClawHub (snapshot Oct 27). Headline: more than 65% of analyzed skills are vulnerable — unsafe behaviors that expose agents to sensitive systems, wallets, untrusted third-party content or hardcoded credentials — and the ecosystem remains a significant supply-chain risk. Overtly malicious skills are rarer but more sophisticated: Snyk's updated engine flagged 2 critical skills on skills.sh and 7 on ClawHub. Patterns include lookalike API endpoints that harvest keys (e.g. api-w3stream.attoaioz.cyou impersonating AIOZ Stream), an agents-md 'validator' that runs an opaque binary then silently appends attacker instructions to ~/.claude/CLAUDE.md, obfuscated code that forbids decompilation, and skills that append insults or enroll agents in external 'governance' under a curl diagnostic pretext.

[← Context & Harness Attacks](/context) · [markdown](/items/snyk-agent-skill-ecosystem-reassessment-skills-sh-clawhub-nov-6.md)

confirmed research (Snyk research blog, Nov 6); top 10k skills on skills.sh and ClawHub as of Oct 27 snapshot; critical=actively malicious per Snyk severity model

2026-11-06

### Snyk: >65% of top agent skills on skills.sh / ClawHub are vulnerable; 9 critical malicious skills (lookalike APIs, silent CLAUDE.md plant)

- **Critical counts:** skills.sh 2 / ClawHub 7 (prompt-injection / malicious-download classes can produce Critical; other categories flag vulnerable-but-not-malicious).
- **Unsafe-behavior scale:** thousands of skills touch system services, third-party content, unverifiable deps, credential handling or direct financial capabilities.
- **Ops rule:** install skills only from publishers you can verify; review what a skill reads, runs and pays for; keep wallet keys out of agent reach; re-scan popular skills as evasion evolves.
- Snyk says the updated engine is rolling into Snyk Agent Scan / Evo and into skills.sh scanning.

Sources: [Snyk Research: Re-Assessing the Security of the Agent Skill Eco System (Nov 6)](https://research.snyk.io/blog/skill-analysis/)