What a Jar of Peanut Butter Teaches About Agent Skill Security
A jar of peanut butter passes through a dozen hands before it reaches your toast, and you trust every one of them without thinking about…
What a Jar of Peanut Butter Teaches About Agent Skill Security
_Philadelphi_a
A jar of peanut butter passes through a dozen hands before it reaches your toast, and you trust every one of them without thinking about it. The farm that grew the peanuts. The plant that roasted and ground them, filled the jar, and printed the label. Trucks, a warehouse, and everyone passing the shelf that it sits on. You do not test for Salmonella before you make a sandwich. You read the label, maybe, and you trust the chain.
An agent skill reaches your tools the same way, through a chain of hands you mostly do not see, and you install it with about the same scrutiny you give the peanut butter jar. Walk a jar from the field to your pantry, mark every place contamination can enter, and you have a working map of where an agent skill can be poisoned. The map matters now more than ever because the skill, unlike the peanut butter, often runs with your access across your system once you let it in.
From the peanut field to the peanut plant
A skill is built from ingredients the author did not all grow: instructions copied from somewhere, a helper script lifted from a gist, a library that the script pulls in when it runs. Each of those came from its own chain. A poisoned ingredient enters here, before the author has done anything wrong, the way aflatoxin rides in on a bad lot of peanuts. The author then, in good faith, adds a skill to a component that was already compromised.
In 2008 and 2009, the Peanut Corporation of America shipped contaminated peanut products. Salmonella from a single processing plant moved out through the distribution network into crackers, cookies, and dog food, contributed to nine deaths, and sickened more than seven hundred. Nothing about the finished products looked wrong. The contamination went in at one point upstream and rode the chain to every shelf that carried the brand.
A skill has its own plant, the SKILL.md body and the scripts bundled beside it. When the agent activates the skill, it reads that body as instructions and follows them with the authority you have given it. Three lines of ordinary Markdown in the body can redirect what the agent does, and researchers have shown how. The body can also tell the agent to fetch code from a web address and run it, meaning the dangerous part doesn't need to sit in the file you installed at all. It arrives at runtime, from somewhere you never looked, the way a clean-looking jar carries whatever the plant put in it.
The label is an instruction
On a jar, the label makes a claim. Natural. No additives. A list of ingredients you can check against what you expected. Food labeling can lie, and regulators exist partly because it has, but the label and the contents are at least separate things. You can open the jar and find out.
A skill’s label is its frontmatter, the short name and the description at the top of the file. Nothing in the format enforces a relationship between the label and the contents, so the description can promise to format your meeting notes while the body does something else entirely. The label also goes somewhere a jar’s label never does. The agent reads it, at the moment it decides which skill to pull in, and an instruction hidden in the description executes with that decision. What you trust to tell you what is inside can carry behavior that an attacker put there. Imagine a jar whose label, when you so much as glanced at it, could reach into the kitchen.
Onto the shelf
Getting a jar onto a store shelf takes contracts, audits, and a brand the retailer agrees to carry. A skill needs a Markdown file and a GitHub account a week old. Nobody signs it, no review stands in the way, and by default nothing sandboxes what it does. The registries distributing skills today work the way npm and PyPI worked in their early years, before either learned, at great expense, what an open door costs.
A shopper reaches for the jar at eye level. The agent reaches for the skill at the top of the search the same way. Small textual tricks in a skill’s text can push an adversarial version up a registry’s rankings and bias an agent’s selection toward it, even when a clean equivalent sits right beside it, an effect researchers have demonstrated repeatedly. Where a registry runs an automated scanner as its inspection, semantic evasion slips malicious skills past the verdict a good share of the time. The knock-off sits on the shelf next to the brand you meant to buy, with a near-identical name, and the agent picks one by reading the label.
The package can also change in transit. You do not always pull a skill from the tidy front of a registry. You clone a repository, accept a pull request, or open a shared project template, and any of those can carry a skill or a context file that is not what the original author published. A forged mirror, a poisoned fork, a single malicious commit, and what reaches your machine is not what the shelf advertised. A signed, verified package would catch the swap. Skills mostly travel unsigned.
A security audit of close to four thousand published skills early in 2026 found that more than a third carried at least one security flaw, and roughly one in seven carried a critical one, from prompt injection to outright malware to leaked credentials. A separate coordinated campaign pushed hundreds of malicious skills into a popular registry over a few weeks.
Those audits and campaigns came out of open registries, the kind where anyone stocks a shelf with a week-old account and nothing inspects the upload before your install. A curated catalog that a vendor reviews before listing is a different shelf, with different odds, and the risk tracks how open the source is. So far the bad jars have shown up in the open bins.
After you have trusted it
The 1982 Tylenol murders were not a manufacturing failure. The product left the plant clean. Someone pulled bottles off store shelves, laced the capsules with cyanide, and put them back, and seven people in the Chicago area died from a brand they had every reason to trust. The industry responded with the tamper-evident seal, the foil and the shrink band that now feel ancient, invented so a buyer could tell whether the chain had been broken after the product was made.
Skills have the same problem and, for now, none of the seal. A skill can pass review, earn a reputation, and accumulate installs, and then change. The author’s account gets compromised, or the author was simply patient, and a later version carries the payload the reviewed version did not. Because most installs track the latest version rather than a pinned one, the update arrives quietly, into tools that already trust the skill. The brand on the shelf stayed the same while the recipe changed after you started buying it.
In your pantry
Bring the jar home and you trust it without checking. It goes in the pantry, on your toast, in your kid’s sandwich. Whatever is in it is now in your kitchen.
A skill you install reaches further than a jar does. It runs with the full access of the agent it extends, which is the access you granted that agent: your files, your credentials, the systems your agent can reach through its connections, the open internet. A malicious one does not act once and leave. It runs again on the next task that matches its description, quietly, as part of work you believe you are directing.
Some skills, once active, write altered instructions into other files the agent reads, the project’s CLAUDE.md or a shared configuration. Researchers have documented the trick. Remove the original skill and the poison remains, sitting in a context file you never thought to check, and it travels to every teammate who clones or pulls the repository. One contaminated jar, and now the whole kitchen is suspect, along with the kitchen of everyone you cooked for.
What the food system learned
Food safety improved by building inspection into the chain at the points where contamination enters, not by asking anyone to trust harder. A regulator stands behind that, an inspection regime and a body of standards the whole industry has to meet. Skills have no equivalent yet. The registry-level review, the signing, the provenance that would let you verify a skill the way an inspection stamp vouches for a cut of meat, all of it is still being built, and unevenly. Until it arrives, the checking falls to you and your team, and a few of the moves the food system made map onto what you can do alone.
Read the ingredients, and read the recipe. The grocery store never lets you do that; the SKILL.md format does. The file ships as plain text, and so do the scripts beside it. Before a skill runs with your access, open it and read what it tells the agent to do, including the parts that fetch, write, or reach out. Install a skill you have not read and you have bought a jar with the label torn off.
Buy from sources you trust. An unknown author is a stranger handing you a script that runs with your access. Prefer skills you wrote, ones your organization vetted, or ones from a publisher with something to lose.
Make your own seal. Pin to a specific version so a later one cannot change the recipe without your noticing. Where signing and provenance exist, use them, and favor the registries and tools building them, because the ecosystem that adds the foil and the shrink band is the one worth standing in.
Run the inspection as a team. A skill is a dependency, and it deserves the review you already give dependencies: read before merge, pin the version, and keep a record of which skills ran in which sessions. The persistence problem means cleanup extends past deleting the skill, to auditing every context file the skill could have touched while it was active.
Hold the access down. The skill can only reach what the agent can reach. The narrower the agent’s permissions, the smaller the blast radius when a jar turns out to be bad.
The one advantage you have
The barrier to publish sits below a grocery store’s, the label can carry behavior, the seal does not exist yet, and the blast radius reaches your whole environment and your teammates’ too. Read it honestly and you have npm in 2015, with the added twist that the package talks directly to a model holding your credentials.
Unlike a sealed jar, you can read a SKILL.md before you trust it. The name, the description, the body, the bundled scripts, all of it ships as plain text. The ecosystem discourages the reading anyway, with one-click installs and labels the machine reads on your behalf, the same frictionless path that made npm both wonderful and dangerous. Open the SKILL.md and read it before you install it.
By Joshua McDonald on June 1, 2026.
Exported from Medium on August 26, 2026.
Reader discussion