Treat SKILL.md as Runtime, Not Docs

You did not install a README. You installed a prompt that inherits your agent’s tools: the skill description already sits in the system prompt, the SKILL.md body loads on trigger, and bundled scripts can run without the source ever appearing in chat. Review the full skill tree before first load, bind install to a content hash—not the name or registry blurb—treat ranking as adversarial, and re-hash after any writeback. Same instinct as binding MCP approval to content, different artifact.

1. Hook: you already loaded the selector

You pulled a skill from a registry by name. The install UI looked like documentation. The agent already has that skill’s description in its system prompt.

That is not a README waiting on disk. Under the open Agent Skills model, every installed skill contributes name and description at startup (~100 tokens each). When the agent decides the description matches the task, it loads the full SKILL.md body into context. Bundled scripts/, references/, and assets/ load only as needed. Scripts can execute so that only stdout enters the chat—a reviewer who only reads the conversation never sees the payload. [1][2][3]

The useful question is narrower than “helpful skill?”: what exact instruction tree just inherited your tools?

2. Loading model in three sentences

Startup: name and description for every installed skill go into the system prompt. Trigger: the agent matches the user request against those descriptions, then reads the full SKILL.md (Claude’s product docs: often via bash). Level 3: bundled files on demand; scripts may run without their source entering context.

The open spec places no format restrictions on the markdown body. Its validator checks frontmatter. It does not pin content, sign packages, or force re-approval when the tree changes. [1][2][3][4]

Claude Code’s allowed-tools is a turn-scoped grant, not a hard deny-list for other tools. Live reload of SKILL.md edits in-session is documented. Neither is a content-integrity control. [4]

3. Short answer

Field rule: Review the full SKILL.md tree as a prompt that inherits tools. Bind install/load to a content hash, not name/description. Treat registry ranking as adversarial. Re-hash after any skill writeback.

This sits next to last week’s rule: bind MCP approval to content, not the tool name. Pin the bytes you reviewed; re-consent on drift. MCP was the executable config and tool definition. This week the object is the skill directory—frontmatter, body, scripts, references, assets.

4. Evidence: rank, camouflage, writeback

Three 2026 preprints (not peer-reviewed) cover the lifecycle. Treat the numbers as field evidence, not settled law.

Rank and select before you “run” anything

Saha, Faghih, and Feizi (arXiv:2605.11418) study a registry adversary who can change only SKILL.md text—no code, no aux files, no registry backend. Discovery attacks reach an 86.14% pairwise win rate and 80% Top-10 placement against OpenAI text-embedding-3-small. On a ClawHub-style ranking replica (n=100 skills), avg-day win rate is 74.14%; a 0-day skill hits 94% at t=0 and 40% after one hour. Description-only adversarial variants win selection in 77.6% of paired trials on average. Governance evasion (avoid a block) spans 36.5%–100%. Context-window overflow labeled 87.1% of cases clean and 0% malicious. Truncating review to the first 10K characters is an attack surface, not a control. [5]

Authors’ framing: SKILL.md is operational text that shapes which third-party capabilities agents find, trust, and use.

Camouflaged runtime after install

Qu et al. (arXiv:2604.03081) assume retrieval already succeeded. They poison the skill body with DDIPE—malicious logic dressed as benign code examples and config templates. From 81 seeds they build 1,070 adversarial skills across 15 MITRE categories. End-to-end bypass rates run 11.6%–33.5% (n=1,070). Explicit-instruction attacks drop to 0% under their strong-defense setup: scanners catch shouting; they miss camouflage. Static SkillScan intercepts 90.7%; 2.5% (27/1070) evade static analysis and alignment. Cross-model joint bypass on Claude Code: 1.6%. Four vulns disclosed; two fixed. [6]

Registry incidents show the same class of problem in separate snapshots. Do not merge them into one “current” count.

Snyk’s ToxicSkills scan as of 5 Feb 2026 covered 3,984 skills on ClawHub + skills.sh. From the body table (ignore the page H1): 1,467 (36.82%) had any security issue; 534 (13.4%) had at least one critical; 76 HITL-confirmed malicious payloads; 8 still listed live on ClawHub as of that publication (IOCs not re-checked on 2026-09-14). At research time Snyk described the publish barrier as a SKILL.md plus a roughly one-week-old GitHub account—no signing, no review, no default sandbox. Payload shape was often natural-language setup instructions that steer the agent, not a classic binary in the registry entry. [7]

Separately, Trend Micro reported 39 OpenClaw skills used to push Atomic macOS Stealer, also found on skills.sh / SkillsMP. [8]

A later ClawHub Security Signals export (31 May 2026) covered 67,453 latest public versions: ClawScan 61.9% clean / 37.8% suspicious / 0.3% malicious (206). Those are automated silver-standard labels, not human ground truth. SkillSpector findings are advisory and do not alone block install. [9][10]

Writeback after the first green install

Ning et al., SkillHarm (arXiv:2606.02540): 879 samples across 71 skills and 12 risk types. Two scenarios matter on the desk. Fixed-Payload Poisoning (FPP) harms in the same session. Self-Mutating Poisoning (SMP) rewrites persistent skill content on first run; harm shows up on reuse. Peak ASR: FPP 86.3%, SMP 69.3% (Codex / GPT-5.4). Claude Code / Opus 4.7: FPP 27.4%, SMP 9.4%—but conditional ASR jumps +32.1 points on SMP when you stop counting “never opened the file” as a defense. Scanners top out at 55.6% FPP / 68.8% SMP detect. Defensive system prompts: nearly all configs still >70% ASR. [11]

One-time install review does not survive SMP. “Didn’t fire this session” is not refusal.

5. What fails

1. Reviewing the name or registry blurb. Description-only selection wins 77.6% of paired trials in 2605. [5]
2. Treating SKILL.md as a README. Spec: no body format restrictions. Anthropic / Claude docs: description is the match key; body is instructions that inherit tools. [1][2][3]
3. One-time install review. SkillHarm SMP mutates after first run; Claude Code documents live reload of SKILL.md edits. [4][11]
4. Scanner / ClawScan / SkillSpector as a gate. ClawHub: SkillSpector findings are advisory. SkillHarm scanners miss a large share; 2605 overflow labels overflowed files clean. [5][9][11]
5. A defensive system prompt. SkillHarm: still >70% ASR for nearly all configs. [11]
6. allowed-tools as a sandbox. Spec: experimental. Claude Code: turn-scoped grant, not a deny-list; unlisted tools remain callable under normal permissions. [1][4]
7. Reading only the chat. Scripts can run so only stdout enters context. [3]

Related surfaces on this site—same “text that runs with tools” problem, different artifacts: MCP tool poisoning, MCP prompts at the tool boundary, treat GitHub issues as agent input.

6. Checklist

Practice, not a compliance matrix:

1. Inventory installed skills the way you inventory MCP servers: path, publisher, purpose, who approved.
2. Read the whole tree before first load: frontmatter, body, scripts/, references/, assets/, and any curl / network / env / hook instructions. Assume scripts may run without appearing in chat.
3. Pin a content hash of the skill directory (canonical file set). If the hash changes—including after the agent writes back—treat it as a new consent event. CSA’s May 2026 note names content-hash verification before production load explicitly for skills. [12]
4. Do not auto-load from description for untrusted skills (disable-model-invocation / slash-only where the product supports it). [4]
5. Allowlist publishers / marketplaces (Claude Code strictKnownMarketplaces / plugin allowlists exist). Registry rank is an attack surface, not evidence of safety. [13]
6. Least privilege outside the model: no extra tools, no secrets in env, default-deny egress. allowed-tools is not this control.
7. Re-run the hash + a denied-path test after updates—same move as agent capability diffs.

Vendor posture today is still mostly “audit it like software”: trusted sources, read SKILL.md and scripts, marketplace allowlists. Fetched Claude / agentskills docs do not document cryptographic pin of the skill body plus forced re-approval on hash drift. That control has to live in your install path. [2][3][4][12]

skills.sh’s audit board is useful telemetry. The docs state an explicit no guarantee on every skill. [14][15]

7. Close

Last week you pinned the MCP config. This week you pin the skill file.

Approval follows the bytes you reviewed, not the familiar label. The skill object is a progressive-disclosure instruction tree: it can rank itself into view, hide payload inside an example, and rewrite itself after first use.

If you install from our hub, take the rule with you—full-tree review, content hash, no silent reload after writeback. Start at /skills/.

Sources

1. Agent Skills Specification — https://agentskills.io/specification
2. Anthropic Engineering, “Equipping agents for the real world with Agent Skills” — https://www.anthropic.com/engineering/equipping-agents-for-the-real-world-with-agent-skills
3. Claude Platform docs, “Agent Skills overview” — https://platform.claude.com/docs/en/agents-and-tools/agent-skills/overview
4. Claude Code docs, “Extend Claude with skills” — https://code.claude.com/docs/en/skills
5. Saha, Faghih, Feizi, “Under the Hood of SKILL.md: Semantic Supply-chain Attacks on AI Agent Skill Registry,” arXiv:2605.11418 (preprint, submitted 12 May 2026) — https://arxiv.org/abs/2605.11418
6. Qu et al., “Supply-Chain Poisoning Attacks Against LLM Coding Agent Skill Ecosystems,” arXiv:2604.03081 (preprint, submitted 3 Apr 2026) — https://arxiv.org/abs/2604.03081
7. Snyk, “ToxicSkills: Malicious AI Agent Skills on ClawHub” (corpus as of 5 Feb 2026) — https://snyk.io/blog/toxicskills-malicious-ai-agent-skills-clawhub/
8. Trend Micro, “Malicious OpenClaw Skills Used to Distribute Atomic macOS Stealer” — https://www.trendmicro.com/en_us/research/26/b/openclaw-skills-used-to-distribute-atomic-macos-stealer.html
9. Hugging Face / OpenClaw, “ClawHub Security Signals” (snapshot 31 May 2026) — https://huggingface.co/blog/OpenClaw/clawhub-security-signals
10. OpenClaw, “OpenClaw × NVIDIA skill security” — https://openclaw.ai/blog/openclaw-nvidia-skill-security
11. Ning et al., “SkillHarm: Lifecycle-Aware Skill-Based Attacks via Automated Construction,” arXiv:2606.02540 (preprint, submitted 1 Jun 2026) — https://arxiv.org/abs/2606.02540
12. Cloud Security Alliance, “SKILL.md / Agent Context Poisoning” research note (6 May 2026) — https://labs.cloudsecurityalliance.org/wp-content/uploads/2026/05/CSA_research_note_SKILL_md_agent_context_poisoning_20260506-csa-styled-1.pdf
13. Claude Code docs, settings reference (marketplace / plugin allowlists) — https://code.claude.com/docs/en/settings-reference
14. skills.sh docs — https://www.skills.sh/docs
15. skills.sh audits — https://www.skills.sh/audits