Snyk Finds Prompt Injection in 36% of Payloads in a ToxicSkills Study
Snyk security researchers found prompt injection attacks in 36% of payloads uploaded to ClawHub, a platform for sharing AI agent skills. The study, named ToxicSkills, highlights vulnerabilities in the AI supply chain, where malicious code can be embedded in skills for AI assistants, posing risks to users who download and execute untrusted agent functionality.
Background
- Snyk is a well-known cybersecurity company that specializes in developer security and open-source vulnerability research.
- This article describes "ToxicSkills," a threat where attackers upload malicious "skills" (plugins/extensions) to AI agent platforms like ClawHUB (a fictional or pseudonymous marketplace for AI agent add-ons).
- A "prompt injection" attack manipulates an AI's system instructions/prompt to override its intended behavior, making it ignore safeguards and follow attacker commands.
- The study found that 36% of tested malicious payloads on ClawHUB contained prompt injections, meaning the AI agent skills were designed to hijack the model's instructions — potentially to exfiltrate data, run unauthorized commands, or spread malware.
- The broader context: AI agents are increasingly given access to tools, APIs, and personal data in a "trust the agent" model. ToxicSkills shows how this trust can be exploited at the plugin level, analogous to the decades-old problem of malicious browser extensions or npm packages.