SKILLS & PROMPTING · 22 OCTOBER 2026
Check what your agent skills could leak
Two security warnings about agent skills are doing the rounds: one research group says that in a sample of 17,022 skills from a public marketplace, 520 leaked credentials, mostly by accident through ordinary print or log lines, and JFrog's 2026 report, as quoted by @WebWrightAI, counted 969 malicious agent skills. These are the researchers' own figures, and we haven't seen the full reports.
Why it mattersSkills are code your agent runs with your keys. Install them only from sources you trust, skim what they do first, and keep API keys where a skill can't print them.
Sources
How we knowCompany figures are labelled as their own claims; anything we couldn't verify is labelled as a report or a claim.
MORE FROM 22 OCTOBER 2026
- Claude Duet: Anthropic's proactive agent app (US waitlist only, not in the UK yet)
- OpenAI says its models helped find a critical PHP flaw, and there's a Codex skill to check your site
- Recursive's Flint: a free coding model that runs offline on your laptop
- Claude Security now re-scans your code every time it changes
- OpenAI's models are coming to Google Cloud
- Gemini 4 Argon builds a 3D anatomy explorer, plus a Gemini 4 Carbon rumour