Securing AI Agent Skills and MCP Supply Chains
Snyk reveals that 13.4% of published AI agent skills contain critical security vulnerabilities. This analysis explores the emerging threat landscape of prompt injections, obfuscated code, and supply chain risks in LLM ecosystems, offering actionable strategies for developers and security teams to mitigate these risks.
The Emerging AI Supply Chain Crisis
The rapid proliferation of AI agents and Large Language Model (LLM) integrations has created a new, critical vector for cyberattacks. Recent data from Snyk indicates that 13.4% of all published AI skills contain at least one critical security vulnerability. This statistic underscores a fundamental shift in the threat landscape: the supply chain risk has moved from traditional software dependencies to the natural language instructions and executable scripts that power AI agents.
Obfuscation and Prompt Injection
The primary threat vector is not traditional malware, but sophisticated prompt injections. Attackers exploit the natural language processing capabilities of LLMs by embedding malicious instructions within skill files. These instructions are often obfuscated using Base64 encoding, Unicode smuggling, or non-standard languages to evade human review. Once an agent processes these hidden commands, it may execute unauthorized actions, such as downloading binaries, exfiltrating credentials, or exposing code to the internet. Because these skills often run with root privileges on local machines, the potential impact is severe.
Strategic Implications for Enterprises
For enterprise leaders, this represents a significant operational risk. The speed at which developers adopt AI tools often outpaces security protocols, leading to a "move fast, break later" mentality that is untenable in a production environment. The lack of standardized security checks for AI skills mirrors the early days of open-source dependency management, where vulnerabilities were common due to a lack of oversight. Organizations must now treat AI skills and Model Context Protocol (MCP) servers as critical supply chain components, requiring the same level of scrutiny as traditional software libraries.
Actionable Security Frameworks
Mitigating these risks requires a multi-layered approach. First, developers must adopt a "trust but verify" mindset, pinning specific versions of skills to prevent silent malicious updates. Second, automated security scanning tools, such as Snyk Agent Scan, should be integrated into development workflows to detect anomalies and potential prompt injections before deployment. Third, security teams must implement runtime guardrails to monitor and block unauthorized model calls, preventing shadow AI from compromising the enterprise environment. By shifting security left and integrating continuous monitoring, organizations can secure their AI infrastructure without stifling innovation.
Key insights
-
A significant portion of the AI skill ecosystem is compromised, with 13.4% of scanned skills containing critical vulnerabilities. This high prevalence suggests that security is not a priority for many skill creators, creating a systemic risk for users.
Impact: Enterprises relying on unvetted AI skills face immediate exposure to data breaches and system compromise, necessitating rapid adoption of security scanning tools.
-
Prompt injection remains the most critical threat, utilizing obfuscation techniques like Unicode smuggling and Base64 encoding to hide malicious instructions from human reviewers while remaining readable to LLMs.
Impact: Traditional code review processes are insufficient for detecting these threats, requiring specialized AI-aware security tools that can parse natural language for malicious intent.
-
AI skills and MCPs function as a new supply chain, where unversioned or fluid dependencies can be silently updated to introduce malicious side effects, mirroring historical software dependency risks.
Impact: Organizations must implement strict version pinning and dependency management practices for AI components to prevent unauthorized changes from propagating through their environments.
-
Local execution of AI skills often occurs with root privileges, granting attackers full control over the host machine if a malicious skill is installed and executed.
Impact: The high privilege level of AI agents amplifies the impact of any vulnerability, making local environment isolation and permission management critical for risk mitigation.
-
Security teams are moving from static analysis to runtime monitoring, using tools to actively block unauthorized model calls and enforce policies against shadow AI usage within the enterprise.
Impact: This shift enables real-time protection against emerging threats and provides visibility into AI usage patterns, allowing for more effective governance and compliance.
Action items
-
Integrate automated security scanning tools, such as Snyk Agent Scan, into the CI/CD pipeline to detect vulnerabilities in AI skills and MCPs before deployment.
Impact: Early detection of critical vulnerabilities prevents malicious skills from entering production environments, reducing the risk of data breaches and system compromise.
-
Implement strict version pinning for all AI skills and MCPs to prevent silent updates from introducing malicious code or breaking functionality.
Impact: Version pinning ensures that the exact code being used is known and vetted, mitigating the risk of supply chain attacks via unauthorized updates.
-
Deploy runtime guardrails and monitoring tools to track AI agent activity and block unauthorized model calls or data exfiltration attempts in real-time.
Impact: Real-time monitoring provides an additional layer of defense against prompt injections and shadow AI, allowing security teams to respond to threats immediately.
-
Educate developers on the risks of AI skill security, emphasizing the need to verify the source and permissions of any skill before installation.
Impact: Increased developer awareness reduces the likelihood of installing malicious skills and fosters a culture of security within the engineering organization.
-
Audit existing AI skill and MCP dependencies to identify any critical vulnerabilities and replace or patch them as necessary.
Impact: A comprehensive audit ensures that the current AI infrastructure is secure and compliant with organizational security policies, reducing overall risk exposure.
Quotes
“We scanned 3,984 skills. 13.4% of all skills, which is 534 in total, all contain at least one critical level security issue.”
“I'm basically vibe coding my prompts now or vibe coding my exploits now in that way.”
“You are adding features and functions to your LLM or to your agent in this case, so it can execute that.”