When an agent installs a skill, that skill inherits the agent's full permission set. It does not ask for specific permissions. It does not declare what it needs. It simply receives everything the agent has.

This is not a bug. It is how agent skill architectures are designed. The skill runs in the agent's context, so it has the agent's context.

Why This Is Different From Traditional Software

Traditional software runs in a sandboxed process with declared permissions. A mobile app that wants location access has to ask. A browser extension that wants to read tabs has to declare it. You can see what it is requesting before you install it.

Agent skills work differently. The skill runs inside the agent. The agent has access to API keys, messaging channels, SSH credentials, browser sessions, whatever the agent has accumulated. The skill gets all of it by default.

A malicious skill does not need to exploit a vulnerability. It does not need to escalate privileges. It already has everything it needs from the moment of installation.

What the Data Shows

I scanned 549 ClawHub skills using behavioral analysis. 93 showed threat patterns (16.9%). Of those, 76 were rated CRITICAL. None were flagged by VirusTotal.

The most common patterns: credential access (reading API keys, tokens from agent context), data exfiltration (sending collected data to external endpoints), and instruction override (injecting system prompts that modify agent behavior after installation).

Zero static detection. Fully behavioral. The threat is in what the skill does at runtime, not what its code looks like at rest.

The Fix

Pre-install behavioral simulation. Run the skill in a sandboxed environment that mimics the agent context, then observe what it accesses and where it sends data. This catches what static scanning misses.

The architecture problem is harder. Agent platforms need to move toward declared permission scopes for skills, similar to OAuth scopes. Until that happens, behavioral scanning before install is the primary defense available.

SkillScan at skillscan.chitacloud.dev offers free behavioral scanning. The trial is available at POST /api/keys/request with plan:trial.