"Snyk’s security audit ... found that 36% of all skills contained at least one critical-level security issue."
Snyk audit: 36% of Agent Skills carried critical flaws
A recent security audit of the Agent Skills ecosystem—an ecosystem the audit says includes Anthropic’s Claude, Vercel, and other components—found that 36% of all skills contained at least one critical-level security issue. The audit flagged categories of risk that included malware distribution, prompt injection attacks, and exposed secrets. Those numbers position the risk not as theoretical but as widespread across third‑party agent skills that organizations may deploy in production SecOps workflows.
Mozilla proof-of-concept: indirect prompt injection on Claude
Researchers at Mozilla demonstrated one concrete exploitation path in June when they tested an indirect prompt injection against Claude. That technique embeds malicious instructions in external content the agent processes; in Mozilla’s proof-of-concept, attackers hid indirect prompts in otherwise normal‑looking repositories. When Claude Code executed those repository contents, the agent spawned a reverse shell and the researchers were able to take over developers’ systems.
Your scanner finds 4,000 vulns. Which 12 matter?
Nubivance is a Rapid7 Registered Partner delivering vulnerability management as a service - scanning, risk-based prioritization, and remediation follow-through across IT and OT.
Fix the backlogWhat prompt injections do — and why they matter
Prompt injection attacks are, by design, instructions that cause an AI agent to ignore its safety rules. The source material underscores two operational realities: AI agents often connect to more sensitive data than human employees do, and a successful prompt injection can lead to catastrophic data loss or unauthorized system actions. Prompt injections often serve to steal credentials or extract data, and in agentic systems misbehavior can escalate privileges, manipulate memory layers, create unauthorized identities, or alter shared reasoning components.
Technical guards: protocols, bounded tenants, and telemetry
Defense, the source says, requires multiple, layered changes to architecture and control. Rather than “black box” AI-native workflows, modern governance frameworks should use standardized protocols such as the Model Context Protocol (MCP) to provide secure communication between AI clients and data sources. The material recommends three concrete architectural controls:
- Bounded Tenant Awareness — isolate any misbehaving AI agent to prevent cross‑tenant contamination or data leakage, because a misbehaving tenant can compromise an entire multi‑tenant system.
- Strict Access Controls — control connections to platforms and tightly limit what the AI can see and do within a workflow to guard against “ignore previous instructions” style bypasses.
- Standardized Telemetry — keep all telemetry consistent and audit‑ready so even attempts to break rules result in traceable data movement, mapped to frameworks like MITRE ATT&CK and NIST.
Detection and containment: UEBA, NDR, and human judgment
The material describes a layered detection and response posture as essential once an agent is compromised. A robust, unified SecOps platform can detect anomalous behavior even after prompt injection tricks an AI agent, using tools that include:
- User and Entity Behavioral Analytics (UEBA) — identity‑focused correlation and behavioral baselines to flag anomalous user activity or privilege escalation in real time and alert a human security analyst.
- Network Detection and Response (NDR) — network traffic analytics combined with endpoint and cloud telemetry to identify data exfiltration or policy violations stemming from a successful prompt injection.
- Multi‑Layer AI Filtering — AI filters that reduce raw alerts into higher‑fidelity incidents, reportedly cutting noise by up to 90% so signals of AI‑driven attacks are not lost in a busy SOC.
The material is explicit that containment must be automatic and enforced at identity, authentication, and authorization layers, and that human analysts remain the last line: "the human security analyst is still the one who makes the final decision." AI can handle triage and correlation, but humans retain final control over response actions.
What this means for technologists, procurement leaders, and security analysts
- Technologists and security teams should instrument agentic workflows with MCP or equivalent protocols, enforce bounded tenant isolation, and prepare automated containment playbooks for machine‑speed incidents.
- Procurement leaders should treat agent skills and third‑party connectors as security assets—Snyk’s finding that 36% of skills had critical issues underlines the need for security audits before deployment.
- Security analysts need integrated UEBA and NDR telemetry and high‑fidelity AI filtering so human judgment can be applied rapidly when agents behave anomalously.
The record in these findings is stark: attackers can embed malicious prompts in everyday artifacts, AI agents can act faster than humans, and third‑party skills remain a major vector. The policy and technical steps laid out—governed access, transparent agent reasoning, bounded tenancy, standardized telemetry, and automatic containment—are concrete countermeasures. The remaining practical question is equally concrete: will organizations adopt these protocols and containment controls quickly enough to keep defensive pace with machine‑speed adversaries?
