Overview
This series explains why third-party agent skills are a software-supply-chain decision: one package can combine executable helpers, natural-language instructions, and platform authority. It follows the path from registry discovery through installation, measurement, attack-chain analysis, strategy differences, concealment, and layered defense. The evidence comes from a January 2026 study of 98,380 skills in two public registries, confirming 157 malicious skills as a high-precision lower bound—not a universal prevalence rate.
Learning outcomes
- A third-party agent skill can influence both the agent’s decisions and the host environment, so code-only review is insufficient.
- The study’s 157 confirmed malicious skills are a high-precision lower bound from two public registries, not a universal prevalence rate.
- Attack risk often comes from layered behaviors—collection, execution, concealment, transmission, or instruction override—rather than one isolated red flag.
- Trust requires matching publisher claims with observed behavior, constrained authority, agent-aware monitoring, and a workable response path.
Keywords
Preview every chapter · Unlock full text, audio, and video from chapter 4
PlansFAQ
What makes a third-party agent skill a supply-chain risk?
A third-party agent skill becomes a supply-chain risk when a registry-distributed package enters a locally privileged environment and can influence both host execution and the agent’s decisions. The concern is the gap between its public contract and actual authority or behavior.
What do the 157 confirmed malicious agent skills prove?
They prove that intentional abuse was present in the January 2026 snapshot of 98,380 skills from two public registries, not that 157 is the total or a universal risk rate. The confirmed set is a high-precision lower bound under the study’s conditions.
Why must agent-skill reviews inspect instructions as well as code?
They must inspect both because natural-language instructions can steer tool choices, suppress warnings, or change what the agent tells the user, while helper code can directly affect the host. Reviewing only one path misses part of the package’s control surface.
How should organizations evaluate third-party agent skills?
They should verify identity and permissions, compare instructions and code with the public purpose, test behavior in isolation, limit runtime access, log agent and host effects, and maintain revocation and containment paths. These controls reduce exposure but do not prove perfect safety.