Agent Skill Supply Chain Risks
19 ways malicious skills can compromise your system
Deception
Lie to you
Impersonate trusted sources
Shadow other skills
Create fake urgency
Content Poisoning
Poison context with examples
Agent Integration
Create commands
Auto-execute on load
Code Execution
Run shell scripts
Run Python code
Fetch remote content
Pipe to bash
Install packages
Hooks & Persistence
Create HTTP hooks
Create command hooks
Background async hooks
Write to CLAUDE.md
Evasion
Hide in unicode
Hide in HTML comments
Hide in subagents