The rapid growth of AI-powered crypto tools encountered a sobering reality check on February 5, 2026, as cybersecurity firm Snyk released its groundbreaking ToxicSkills study revealing that 36.82 percent of all AI agent skills in the public ecosystem contain at least one security vulnerability. The report, which scanned 3,984 skills from ClawHub and skills.sh, found 1,467 skills with security flaws and 534 containing critical-level issues including malware distribution, credential theft, and prompt injection attacks.
The Agentic Protocol
The Snyk research represents the first comprehensive security audit of the AI Agent Skills ecosystem, a marketplace of reusable capability packages that instruct AI agents how to interact with tools, APIs, and system resources. These skills power not only personal assistants like OpenClaw but also coding agents such as Claude Code and Cursor, creating a supply chain security challenge that mirrors the early, chaotic days of npm and Python package registries. The researchers identified 76 confirmed malicious payloads designed specifically for credential theft, backdoor installation, and data exfiltration, with 8 of these malicious skills still publicly available on clawhub.ai at the time of publication.
The timing of this report is particularly significant given the explosive growth in AI agent token trading. MEXC, one of the fastest-growing cryptocurrency exchanges, reported on the same day that its January newly listed token spot trading volume surged 65 percent compared to December, with AI tokens and DePIN projects leading the charge. The exchange highlighted that daily skill submissions jumped from under 50 in mid-January to over 500 by early February, a tenfold increase in just weeks.
Neural Network Integration
The intersection of neural network capabilities and blockchain infrastructure creates unique security challenges that traditional application security frameworks were not designed to address. Agent skills operate with the full permissions of their host environment, unlike traditional software packages that typically execute in sandboxed contexts. This means a malicious skill can access file systems, API credentials, and network resources with the same privileges as the agent itself. Snyk found that 13.4 percent of all audited skills contained at least one critical-level security issue, a strikingly high percentage for an ecosystem that handles sensitive financial data and authentication credentials.
The research also documented the first coordinated malware campaign targeting users of AI coding agents, with over 30 malicious skills distributed through ClawHub in a single coordinated operation. These skills employed prompt injection techniques to manipulate the host agent into executing unintended commands, potentially exposing private keys, wallet seeds, and API tokens to attacker-controlled servers.
Token Utility
AI-focused crypto tokens have emerged as the primary vehicle for funding and incentivizing the development of agent skills and decentralized AI infrastructure. With the total market capitalization of AI-focused cryptocurrencies growing rapidly in early 2026, these tokens represent both the promise and the peril of the AI-blockchain convergence. MEXC’s data showing a 65 percent volume surge in newly listed AI tokens indicates strong market demand, but the Snyk report suggests that much of the underlying infrastructure remains dangerously insecure.
The DePIN sector, which encompasses decentralized physical infrastructure networks providing compute power for AI workloads, represents a growing segment of this market. Projects building decentralized compute platforms, GPU marketplaces, and distributed inference networks are attracting significant capital, but their security foundations must mature to match their market valuations.
Potential Bottlenecks
Several obstacles could slow the development of a secure AI agent ecosystem. The hypergrowth in skill publications outpaces the capacity of security auditors to review submissions, creating a widening gap between available skills and verified-safe skills. The Snyk researchers intentionally tuned their detectors to minimize false positives, meaning the 36.82 percent figure likely understates the true scope of security issues in the ecosystem.
Additionally, the cross-platform nature of agent skills creates complex dependency chains where a vulnerability in a single shared component can propagate across dozens of downstream applications. The lack of standardized security frameworks for agent skill development means that each ecosystem, whether OpenClaw, Claude Code, or Cursor, must independently develop and enforce its own security policies.
Final Verdict
The ToxicSkills report serves as a necessary wake-up call for the AI crypto ecosystem. The 65 percent surge in AI token trading volume reported by MEXC demonstrates genuine market enthusiasm for AI-blockchain convergence, but the 36.82 percent vulnerability rate in agent skills reveals an infrastructure that is scaling faster than its security foundations can support. For investors and developers alike, the path forward requires treating security as a first-class concern rather than an afterthought. The projects that will ultimately succeed in this space will be those that can combine innovative AI capabilities with rigorous security practices, earning user trust through demonstrated safety rather than marketing claims.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Always conduct your own research before engaging with any cryptocurrency protocol or token.
534 critical issues in agent skills and most devs probably dont even read the source before installing. supply chain attacks evolved faster than the defenses
534 critical-level issues out of 3984 skills scanned. thats 1 in 7 skills having a serious vulnerability. npm all over again but worse because these things have filesystem access
skill_installer_42 npm comparison is generous. at least npm packages run in a sandbox usually. AI agent skills literally get told to go execute commands. the blast radius is way bigger
76 confirmed malicious payloads and they were up for how long before Snyk found them. the review process on ClawHub is basically non-existent
76 confirmed malicious payloads out of 3984 scanned is nearly 2%. thats not a vulnerability rate thats an active supply chain attack campaign
76 confirmed malicious payloads out of 3,984 skills scanned. thats nearly 2% of the entire ecosystem being actively malicious, not just buggy
Rasmus B. and the detection rate is probably lower than reality. Snyk can only scan what is public. private skill marketplaces and custom deployments are completely unmonitored
skill_sandbox_ private marketplaces being unmonitored is the real threat. Snyk can only scan public repos. enterprise custom skills are a complete blind spot
sandbox_please_ private enterprise skills are the real blind spot. at least public ones get community review eventually
36% of skills have vulns and 76 confirmed malicious payloads. and people wonder why i am skeptical of installing random agent plugins
534 critical-level issues out of 3,984 scanned. thats a 13% critical vulnerability rate. supply chain security for AI agents is basically nonexistent rn
13% critical vulnerability rate is actually worse than npm at peak left-pad era. and these skills have shell access not just node modules
vuln_scan_ comparing it to npm left-pad is generous. npm packages dont get shell access and api keys by default. agent skills are a fundamentally worse security model
supply_chain_maxi exactly. npm packages dont get shell access by default. agent skills literally execute commands on your machine. the blast radius comparison isnt even close
supply_chain_maxi npm packages dont get shell access is the key distinction. agent skills run with full system permissions by default. fundamentally worse security model
skill_inspect_ exactly right. npm requires explicit permissions for shell access. agent skills just get root by default and nobody reads the source
skill_inspect_ npm packages running in a sandbox vs agent skills getting full system access by default is the comparison nobody in the AI space wants to address
Snyk scanning 3,984 skills from ClawHub and skills.sh is a solid sample size. The credential theft vectors are especially concerning for personal assistant tools
the credential theft part is what worries me most. these agents have access to your shell, your files, your api keys. one bad skill and you are drained
prompt injection as an attack vector on agent skills is underrated. the model itself becomes the attack surface
prompt injection on an agent with file system access is basically giving someone a remote shell with extra steps. the security model needs a complete rethink
Zara N. prompt injection on an agent with filesystem access IS a remote shell. people install skills without reading source because the UX makes it frictionless
Zara N. prompt injection giving remote shell access through an agent skill is the new attack vector that traditional security teams have zero tooling for
13% critical vuln rate is actually insanite. imagine if iOS apps had those numbers, there would be congressional hearings
534 critical vulns out of 3984 skills is a 1 in 7 chance your agent plugin has a serious flaw. and people install these things without reading a single line of source