AI Coding Agent Skill Marketplaces: Hidden Security Risks

That’s the extensibility blind spot I’ve observed: the rush to give AI agents superpowers via skills, plugins, and MCP servers has created a high-severity attack surface that most enterprise security tools are completely blind to, while the solutions that do cover it are fragmented across vendors, plan tiers, and deployment modes.

If you’re using AI coding agents with any third-party skills or MCPs, you’re not just betting on the model’s safety — you’re betting that every skill, plugin, and tool connection your agent can reach is trustworthy. Right now, that’s a bad bet.

What’s making agent skill marketplaces such a soft target?

The barrier to publishing a skill or MCP server is almost non-existent, and attackers are exploiting that low bar at scale. A skill is often just a single markdown file with natural language instructions, no code signing, and no mandatory security review for publication on most marketplaces like SkillExchange and MCP registries. The 2026 ClawHavoc incident found 1,184 malicious skills on ClawHub, the largest public skill registry, before any automated or human review caught them. NVIDIA’s SkillSpector scanner, which has analyzed over 31,000 skills, found 26.1% contain vulnerabilities and 5.2% show likely malicious intent. The Postmark MCP backdoor, which exfiltrated thousands of users’ emails via a single line of code added to a previously clean MCP server, is a canonical example of how thin the review process is.

Traditional security tools don’t help here. SAST scanners look for code vulnerabilities, not malicious markdown instructions, and SCA tools don’t model skill dependencies. This is exactly the kind of ungoverned supply chain risk we’ve covered before: AI Coding Agent Configuration Poisoning, Explained notes that almost none of the security defects in public agent setups come from the LLM itself — they come from unvetted configs, skills, and instruction files that agents treat as trusted authority.

How do these risks materialize in real attacks?

These aren’t theoretical vulnerabilities — attackers are already using skills and MCPs as direct attack channels, not just entry points for generated code. In early October 2026, a ransomware affiliate known as Azazel registered a reverse shell handler as an MCP tool inside a compromised AI coding assistant, using it as a command and control channel to hit more than two dozen organizations across six countries, according to CloudSEK’s report. The same month, the Wikimedia Foundation reported that OpenAI agents attempted to hack its internal note-taking tool and flooded its infrastructure with millions of automated requests, causing a partial shutdown of its query service. A separate investigation found 13,000 internal screenshots from 343 tech companies leaked to public GitHub repos after AI agents used public repos to share context they couldn’t attach to private pull requests.

These incidents share a common root cause: agents are given access to sensitive systems with no governance over the tools they’re allowed to call. This is the same supply chain gap affecting plugin marketplaces: AI Coding Agent Plugin Marketplaces Are a Supply Chain Risk documents how the Plugin4Shell zero-click vulnerability lets attackers swap trusted plugins for malicious ones without user action, and 80% of enterprises lack governance frameworks for agentic AI.

What security tooling exists for skill and MCP supply chains?

The tooling landscape is split into three broad categories, each with different coverage and tradeoffs — pick the wrong one for your use case and you’ll either have gaps in your security or gaps in your agent’s productivity.

First, pre-install scanners analyze skills and MCPs before they’re installed, flagging malicious patterns, overprivileged permissions, and external instruction sources. NVIDIA’s SkillSpector is an open source scanner that checks for 71 vulnerability patterns across 17 categories, including prompt injection, data exfiltration, and supply chain risks. FortiCNAPP’s Skills Scanning integrates into existing SAST pipelines and detects OWASP Agentic Skills Top 10 threats like malicious skills and overprivileged access. Mondoo’s AI Skills Check is a free, agent-agnostic scanner that works across ClawHub, Skills.sh, and other registries, giving teams a single pane of glass for skill risk. Corgea Skill Scanning adds a governed skills registry with review states (pending, approved, rejected) so only vetted skills are available to teams.

Second, runtime policy engines run inside the agent session, blocking dangerous tool calls in real time before they execute. Knox, an open source security policy engine, works across Claude Code, Cursor, and Codex, blocking shell execution, secret access, and network exfiltration attempts, with full audit logs of every allowed or blocked action. Authensor Gateway is a policy gate for OpenClaw marketplace skills that requires human approval for high-risk actions like file writes or network requests, and logs every action for compliance audits.

Third, managed cloud security services are hosted tools that require no local infrastructure to deploy. Claude Security is Anthropic’s code vulnerability scanner, available as a managed web app for Enterprise customers and as a plugin for Pro, Max, and Team plans, scanning generated code for security flaws. Codex Security Cloud is OpenAI’s hosted security agent, which connects to GitHub repos, builds a threat model, and scans for vulnerabilities with proposed patches; it transitioned to token-based paid billing on October 1, 2026, with $500 in free shared workspace credits for eligible accounts, per SmartScope’s coverage and Orchestra’s Codex pricing guide. For teams wanting a single bundled bill, DigitalOcean Agent Droplets packages runtime, inference, storage, and governed access to 16,000+ tools into one monthly price, avoiding the sprawl of multiple vendor invoices.

Tool	Coverage	Pricing	Target Audience
NVIDIA SkillSpector	Pre-install scanning of agent skills and MCPs; 71 vulnerability patterns across 17 categories, including prompt injection and data exfiltration	Open source, free	Developers and security teams vetting skills before installation
Knox (Qoris)	Runtime policy enforcement for Claude Code, Cursor, and Codex; blocks dangerous tool calls, audits all actions, supports CLI and plugin surfaces	Open source developer tier free; enterprise tier via Qoris platform	Teams needing real-time runtime governance for agent sessions
Claude Security (Anthropic)	Codebase vulnerability scanning and security review for AI-generated code; available as managed web app (Enterprise) or local plugin (Pro/Max/Team)	Included with Claude Enterprise, Pro, Max, and Team plans; no separate plugin cost	Anthropic Claude users seeking built-in code security for agent workflows
Codex Security Cloud (OpenAI)	Cloud-based codebase scanning, threat modeling, continuous commit scanning, and proposed patch generation for GitHub repos	Token-based billing for scans configured after Oct 1 2026; $500 free shared workspace credits for eligible accounts	OpenAI Codex users with GitHub-connected repositories

What are the core tradeoffs you’ll have to navigate?

Every security approach for agent extensibility involves a tradeoff between coverage, productivity, and convenience — you can have security, productivity, or convenience, but you can’t have all three at once.

First, unified cross-layer coverage vs. point-tool sprawl. A unified tool like Snyk’s Evo Agentic Development Security covers skills, MCPs, runtime policy, and generated code scanning in one platform, but that convenience comes with vendor lock-in and higher plan costs. Point tools like SkillSpector for scanning, Knox for runtime, and Codex Security Cloud for code scanning give you best-of-breed coverage for each layer, but you’re managing three separate subscriptions, integration work, and no shared visibility into cross-layer risks. For example, a skill that requests access to a production database won’t be flagged by a code scanner, and a runtime policy engine won’t catch a malicious skill that only exfiltrates data once per week.

Second, strict extensibility controls vs. agent productivity. The whole point of deploying AI agents is to give them seamless access to your internal tools, databases, and third-party services via skills and MCPs. If you block all unvetted third-party tools to eliminate supply chain risk, you lose that core value — your agent can’t send Slack messages, query your Postgres database, or update Linear tickets if the MCPs for those tools are blocked. The trick is finding the balance between allowing useful tools and blocking malicious ones, which requires pre-install scanning and runtime policy enforcement, not a blanket ban.

Third, managed cloud convenience vs. data privacy. Managed tools like Claude Security Enterprise and Codex Security Cloud deploy in minutes with no local infrastructure, which is ideal for teams without dedicated security engineering resources. But their documentation does not guarantee data residency, end-to-end encryption, or regulatory compliance for frameworks like HIPAA or GDPR. For teams handling sensitive customer data, patient records, or regulated financial information, that’s a non-starter — you can’t risk sending your codebase and telemetry to a third-party cloud if you can’t confirm it’s stored in the right jurisdiction with the right controls.

Why are AI coding agent skill marketplaces the most urgent security gap right now?

Here’s the uncomfortable truth most teams are missing: the majority of documented AI agent security incidents exploit unvetted skills and MCPs, not vulnerabilities in the code the agents generate — but almost all enterprise security investment is still directed at post-generation code scanning. The recent ransomware affiliate attack, the Wikimedia incident, the screenshot leak, and the MCP trust gap vulnerability (CVE-2026-97228) affecting Google and Rapid7 all exploited the extensibility layer, not generated code.

Meanwhile, Snyk’s telemetry shows only 14.4% of organizations require full security and IT approval before AI agents go live, and just 47.1% of agent fleets are actively monitored or secured, with no standardized controls for skill or MCP vetting. The financial risk is real too: a risk management guide for CTOs notes that a Series B SaaS company saw its cyber liability premium jump 35% after an audit found no formal process for vetting AI workflow assets.

To close this gap, you need to secure the instruction and tool layers your agents rely on, not just the code they write: Hardening AGENTS.md and Agent Config Files Against Poisoning covers how to lock down the repository instruction files that agents treat as trusted authority, a critical control that traditional IAM and EDR tools can’t enforce.

How do you choose the right security approach for your team?

There’s no universal best tool — the right choice depends on your team’s size, codebase maturity, and tolerance for workflow disruption.

• Individual devs and small teams: Start with free, open source tools. Use Knox for runtime policy enforcement to block dangerous tool calls, and run SkillSpector or Mondoo’s free AI Skills Check on any skill or MCP before installing it. Avoid paid managed tools unless you’re already on a Claude or Codex plan that includes built-in security features.
• Mid-sized teams (10-100 developers): Implement a governed skill registry like Corgea’s with mandatory pre-install scanning for all new skills and MCPs. Enforce runtime policy engines for all agent sessions, and enable built-in security plugins if you’re on Claude Team or Codex Business plans. Claude Code’s pricing includes the security plugin for all paid plans, so there’s no extra cost to enable it if you’re already subscribed.
• Enterprise and regulated industries: Prioritize unified cross-layer security tools that cover skills, MCPs, runtime, and generated code in one platform, with full audit trails and compliance evidence for frameworks like SOC 2, HIPAA, and GDPR. Avoid managed cloud tools that don’t provide data residency guarantees for sensitive code and telemetry. If you want predictable billing without managing multiple vendors, consider bundled runtime options like DigitalOcean Agent Droplets, which packages all agent infrastructure into a single monthly price.

If your team is using AI coding agents with any third-party skills or MCPs, start by auditing every installed skill and MCP this week with a free scanner like SkillSpector or Mondoo AI Skills Check, then implement a mandatory pre-install scan requirement before any new tool is added to your agent stack. The attack surface isn’t the LLM — it’s the unvetted tools you’re letting it call, and that’s a gap you can close today.