Field guide · AI era
Agent skills · governanceThe first hard numbers on public skills marketplaces arrived in February 2026, and they read like npm in 2016: of 3,984 published agent skills analyzed by Snyk, 36.8% carried at least one security flaw, 76 were confirmed malicious — and 91% of the malicious ones used prompt injection. Skills are artifacts. Here is how to govern them like artifacts, in six steps.
3,984
public agent skills analyzed (ClawHub + skills.sh, Feb 2026)
36.8%
carried at least one security flaw; 13.4% at least one critical issue
76
confirmed malicious payloads — credential theft, exfiltration, backdoors
91%
of malicious skills used prompt injection; 0% of top legitimate skills did
Why this is urgent
An agent skill bundles two things: executable material (scripts, dependencies, tool calls) and natural-language instructions that change what an agent believes it should do. Classic supply-chain controls only ever had to worry about the first. Skills add the second — a payload that no compiler sees, and that Snyk found in nine of ten confirmed-malicious skills as prompt injection: instructions that quietly redirect the agent to exfiltrate credentials, disable safeguards, or fetch external malware.
The distribution side is equally familiar: skills today spread through marketplaces with no review, repos with no versioning, and chat threads with no provenance — the exact conditions that made slopsquatting and dependency confusion profitable in package ecosystems. Every lesson the industry paid for in npm and PyPI applies to skills, unpaid.
The governance model
The sequence matters: each step depends on the one before it. You cannot pin what you do not centrally store, cannot verify what nobody signed, and cannot roll back what nobody versioned.
Route every skill your agents load through one governed registry. A skill that arrives via a repo clone, a chat thread, or a public marketplace is inventory you cannot see — and Snyk found 8 confirmed-malicious skills still publicly listed at publication. Central storage is the precondition for every control that follows.
Publish skills as immutable, versioned artifacts and make agents pull pinned versions. A mutable skill file is an unauditable one: yesterday's reviewed skill and today's edited one share a name and nothing else. Pinning also creates your rollback path — step six depends on it.
Require a signature and provenance record on every version: who published it, from which source, when. Skills impersonating trusted publishers are the skills-world cousin of the name attacks that breached 35+ companies — identity has to be cryptographic, not typographic.
Move skills dev → staging → production through promotion gates that require review — and review the instructions, not just the code. Prompt injection lives in prose a code scanner reads as comments. A production agent should only load skills a human approved at a gate.
Scan embedded scripts, dependencies and links at upload; enforce policy again at pull. Snyk's malicious samples carried base64-obfuscated exfiltration, remote executables and hardcoded credentials (10.9% of all skills!) — exactly what artifact scanners exist to catch.
Record which agent pulled which skill version when — append-only, attributable, exportable. When a skill turns out bad, your response is a version pin and an audit query, not a fleet-wide forensic hunt. Rehearse it before you need it.
Doing this with OrbitalReg
OrbitalReg's agent skills repository implements this model natively: skills are versioned, signed artifacts that move through the same promotion gates, the same upload scanning and verify-on-pull enforcement, and the same append-only audit trail as every other format in your registry — air-gap included. If you already govern your packages with OrbitalReg, governing your skills is configuration, not a project.
Primary sources
Ready to govern your skills?
Rico, the founder, maps the governance model to your current skills workflow — where skills live today, what an agent can load unreviewed, and what the registry of record looks like for you.
