Your Agent Skills Can Silently Steal Your Entire Codebase

A single skill install. No jailbreak. No user interaction. Your entire codebase copied to an adversary's remote, pushed via git, completed before any audit trail is written — and it looks like legitimate agent activity.

Mitiga Labs published a full attack demonstration showing how a malicious agent skill can achieve silent, complete codebase exfiltration with no audit trail. The mechanics are straightforward: skills run with the same permissions as the agent itself, which typically has full filesystem and git access. A skill that adds a remote, stages all files, and pushes is indistinguishable from normal agent operations in logs. The attack completes in seconds.

The scale of the attack surface is what makes this critical. Anthropic launched skills in December 2025; within three months, the top skill on ClawHub hit 200K+ downloads. Independent ToxicSkills research found that 36% of ClawHub skills contain active security flaws — not theoretical vulnerabilities, but working exploit paths. One in three.

This is a textbook supply chain attack pattern. NPM had event-stream. PyPI had ctx. Docker Hub had cryptominers. The agent skills ecosystem is now inheriting the same class of vulnerability, but with a crucial difference: skills run with agent-level permissions that typically include terminal access, filesystem read/write, and network operations. The blast radius of a compromised skill is categorically larger than a compromised library.

What builders should do right now: audit every installed skill for git, network, and filesystem operations that aren't part of the skill's stated purpose. Pin skill versions. Treat skill installation as a security event, not a convenience action. And watch for the Mitiga follow-up — they've indicated additional attack vectors are forthcoming.

The uncomfortable truth: the same composability that makes agent skills powerful makes them a near-perfect supply chain attack vector. We solved this problem in package management with lockfiles, signatures, and scanning. The skills ecosystem has none of that yet.