Malicious skills, MCP servers and extensions

A skill, MCP server or editor extension runs with your permissions: your files, your keys, your mail. In 2026 attackers figured that out, and they work at scale.

After this lesson you have: a 5-minute check you do before you install anything, and you know what to do if something goes wrong anyway.

How it happens

Route	What happens	Real example
Fake “prerequisite”	The skill says: first run this script or paste this into your Terminal. That script is the malware.	ClawHavoc (Feb 2026): 341 of 2,857 skills on ClawHub were malicious; 335 installed the infostealer Atomic Stealer. Publishing only required a GitHub account that was a week old.
Clean first, then the update	An exact copy of a well-known skill builds trust; a later update adds instructions that steal.	skills.sh (Jul-Aug 2026): counterfeit Paperclip and Browser Use skills, more than 1.7 million installs. The malicious instruction sat in a supporting file that the agent only opened when Paperclip had to be installed or started.
Rug pull during use	An MCP server behaves nicely and changes its tools after a few calls.	Deadbugz (Aug 2026, Pillar Security): an MCP server that started hunting for SSH and AWS keys after exactly 3 tool calls.
Tool poisoning	Instructions in a tool’s description. The model reads them, you don’t see them.	Invariant Labs (Apr 2025), including a demo that leaked WhatsApp messages.
Counterfeit package	An npm package with the name of a well-known service, but not from that service.	postmark-mcp (Sep 2025): version 1.0.16 added one line that BCC’d every email sent to the attacker. Postmark had nothing to do with it.
Editor extension	An extension in the marketplace of VS Code-like editors steals tokens and spreads itself.	GlassWorm (Oct 2025): code hidden in invisible Unicode characters, via Open VSX, the marketplace used by Cursor and Windsurf, among others.
Slopsquatting	A model makes up a package or skill name; an attacker registers exactly that name.	With HalluSquatting (Jul 2026), researchers showed this also works for repos and skills.

The pattern: a review at install time tells you little. The harm sits in a supporting file, an update or behaviour that only starts later.

What registries do (and don’t) check

As of November 2026:

Where	What it checks	What it doesn’t
Official MCP Registry	Whether the name belongs to the right GitHub account or domain	No code review. It leaves scanning to npm, PyPI, Docker and marketplaces. Still in preview.
ClawHub (OpenClaw)	Automatic VirusTotal scan with a verdict per skill, repeated daily	Malicious instructions in plain language slip through; OpenClaw itself calls the scan “not a silver bullet”.
skills.sh (Vercel)	Audits by Gen, Socket and Snyk per skill	No “verified” label for the whole registry; the 1.7M campaign got through.
npm / PyPI	Provenance: where a package was built	Not whether it’s good. The Mini Shai-Hulud worm (May 2026) had valid provenance.

Stars and downloads don’t help either: Trend Micro examined 9,695 MCP servers and found hardly any link between popularity and security (Jun 2026).

The 5-minute check

Do this for every skill, MCP server or extension. One “no” is enough to stop.

1. Who publishes it? Does it come from the official GitHub organisation or the domain of the service itself? In the MCP Registry you can tell from the name: io.github.<organisatie>/... or com.<bedrijf>/.... A “postmark-mcp” from an unknown publisher is a clone.

2. Read all the files, including invisible characters. So not just SKILL.md or the README, but supporting files and scripts too. Search for hidden Unicode with:

   find . -type f -exec perl -CSD -ne 'print "$ARGV:$.\n" if /[\x{200B}-\x{200F}\x{202A}-\x{202E}\x{2060}-\x{2064}\x{FEFF}\x{FE00}-\x{FE0F}\x{E0000}-\x{E007F}\x{E0100}-\x{E01EF}]/; close ARGV if eof' {} +

   No output is good. A hit in a file with emoji can be harmless (they sometimes use U+FE0F); in code it’s suspicious. Red flags: a “prerequisite”, curl ... | sh, base64 text, downloads from loose GitHub releases.

3. What permissions and keys does it ask for? A summarising skill doesn’t need a shell, network access or ~/.ssh. Does an MCP server ask for a token for your whole account? Create a separate key with only the permissions it needs, or stop (how to restrict your agent).

4. Look for scripts that run on their own. For an npm package:

   npm view <PAKKETNAAM> scripts

   Is there a preinstall or postinstall? Read what it does. In a repo: check .claude/settings.json (hooks), .vscode/tasks.json ("runOn": "folderOpen") and AGENTS.md/CLAUDE.md.

5. Pin the version and turn off auto-update. In an MCP config you write "<PAKKETNAAM>@1.2.3" instead of just the name (otherwise npx fetches the latest every time). Copy a skill into your own repo or pin it to a commit. In VS Code and Cursor set "extensions.autoUpdate": false. With every update: read the changes first.

6. First run in a sandbox without secrets. Run it in a devcontainer or Docker container in which ~/.ssh, ~/.aws and your .env are not mounted, and watch which connections it opens. A remote MCP server can’t be pinned: it can change its tools on every call. Only use one from a party you’d also trust with your data.

Your sandbox doesn't cover your MCP servers

If you turn on Claude Code’s sandbox, it applies to shell commands. According to its own docs, hooks and local MCP servers run outside it, with your normal permissions. If you really want to lock an MCP server in, run the whole agent in a container or on a separate machine.

Never let your agent search for and install things itself

Attackers now optimise fake repos for agents instead of people. In the AgentBaiting campaign (Island, Jul 2026), more than 800 fake repos posed as a skill or MCP server, and in tests Claude Code, Gemini and ChatGPT recommended them on their own, without anyone providing a link. At most, ask your agent for options; choosing, checking and installing is your job.

Security

If it goes wrong anyway, do this in the first 15 minutes:

• Disable and disconnect. Remove the skill, server or extension. Suspect an infostealer? Take the machine off the network before you go further.
• Every key on that machine is burned, not just the agent’s: SSH, cloud, GitHub, npm, AI services. Revoke them from a different computer and log out everywhere, because stolen session tokens bypass your 2FA (managing secrets).
• Look for hooks left behind in your repos: .claude/settings.json, .vscode/tasks.json, AGENTS.md. Otherwise it starts again the next time you open them.

Checklist

0/6

• I check who publishes a skill, MCP server or extension
• I read all the files and scan for invisible characters
• I only hand over a separate key with minimal permissions
• I check install scripts and hooks
• My skills, MCP servers and extensions are pinned to a fixed version, without auto-update
• Anything new runs in a sandbox without secrets first

Your progress is only stored in this browser.

Test yourself

1. 1An MCP server is listed in the official MCP Registry. What do you know for sure?

   That the code has been checked for malwareThat the name belongs to the stated GitHub account or domainThat the server will never change

2. 2Why does a thorough review at install time only help so much?

   Because skills are always encryptedBecause an update, or behaviour after a few calls, only adds the harm laterBecause reviews only work on Linux

3. 3A new skill says: "Prerequisite: first paste this command into your Terminal." What do you do?

   Run it, it's in the official documentationDon't run it; this is exactly how ClawHavoc spread an infostealerRun it, but only if the skill has lots of stars

Next lesson: Managing API keys and secrets.