Use case · Secure SKILLs hub
SKILLs arrive as plugin bundles installed with a command, and each one can carry code, credentials, and instructions an agent will follow. Optimus Labs inventories every SKILL, analyzes its posture, and governs which ones run.
Published · Updated
It depends on where your SKILLs come from. If you only use a small set of SKILLs written in-house and reviewed in code review, that process may be enough. If employees install SKILL bundles from public repositories and marketplaces, Optimus Labs fits: it inventories every SKILL on every endpoint, analyzes each one for leaked credentials, embedded instructions, and execution paths, and lets you allow, review, or block it by policy. For open-source package vulnerabilities, software composition analysis tools remain the right fit.
Optimus Labs · SKILLs
wallet-syncnpx productivity-plugin install unpacks 3 SKILLs · Owner: Finance team
EvaluatingAvoided: company credentials handed over through a SKILL nobody vetted.
Illustrative scenarios. Bundle and SKILL names are examples, not customer data.
The risk
A SKILL is not a document. It is a bundle that can execute, hold credentials, and instruct an agent. Treating it as harmless text is how the incidents below happen.
A SKILL bundle ships with live tokens or keys inside it.
Technical risk
Anyone who installs the SKILL inherits credentials that were never meant to leave.
Business impact
Account compromise traced back to a file an employee downloaded in good faith.
A SKILL tells the agent to take actions the user never asked for.
Technical risk
The agent follows attacker-written instructions with its full permissions.
Business impact
Data moves or changes hands through a tool the team trusted.
A package or SKILL triggers code execution when published, installed, or built, not just when run.
Technical risk
Trusted build and documentation infrastructure runs supplied code.
Business impact
The compromise happens before any review would ever see it.
SKILLs come from public repositories and marketplaces with no publisher verification.
Technical risk
There is no reliable way to tell a safe SKILL from a malicious one by looking at where it came from.
Business impact
Every install is an unreviewed third-party dependency with agent-level access.
In practice
One example comes from Optimus Labs · Civilizations research, one from public reporting. Each pairs technical risk with business impact and links to its source. Neither is customer telemetry.
From Optimus Labs · Civilizations
Research finding
Our research on agentic SKILLs found that most arrive as part of a productivity plugin installed with a single npx command. One install can unpack scripts, configuration, credentials, and instructions that an agent will follow, with no review step in between.
Technical risk
A bundle can hide executable code and agent instructions behind a friendly name, and runs with whatever access the agent already has.
Business risk
Every SKILL an employee installs becomes an unreviewed third-party dependency with agent-level reach into company data.
What to review
From public reporting
Real incident
An audit of 2,857 SKILLs on the ClawHub marketplace for OpenClaw found 341 malicious ones. Professional-looking documentation told users to install a prerequisite, which delivered the Atomic macOS Stealer and captured API keys and credentials, including those the agent already held.
Technical risk
A SKILL's instructions were the attack. Nothing about its name or marketplace listing marked it as unsafe.
Business risk
Employees installing productivity SKILLs handed over company credentials through a marketplace no one vetted.
What to review
How Optimus Labs helps
01
Discovery finds every SKILL bundle on every endpoint, however it was installed, and maps it to its owner.
02
Static analysis inspects each SKILL for credential leakage, embedded instructions, and execution paths, aligned with the OWASP Top 10 for Agentic Applications.
03
Policies decide which SKILLs are allowed, which need review, and which are blocked, by user, group, or enterprise.
Deploys through your MDM in minutes. macOS and Windows today, Linux coming soon. Prompts and file contents stay on your devices by default. Optimus Labs receives only AI agent asset and behaviour metadata, never PII.
1,708
credential-leakage issues found across 17,022 analyzed agent SKILLs.
Research finding. Measured across public SKILL repositories. It does not describe any single organization's exposure.
Academic research, Jun 1, 2026See it on your own agent assets
Now in early access with design partners. Book a demo to join.
Book a demoBacked by
Ecosystem
