Somewhere on X this fall, a post told Muse users to bookmark ten marketing skills, Content Strategist, Copywriter, and eight more roles, each one a file you copy and paste into a chat, and the post did not say what the files could do once pasted, because it did not need to. A skill file is a brief, Muse follows briefs, and that is both the whole product and the whole problem.
Muse is Meta's personal AI agent, launched September 8, 2026, and it runs on its own computer with a browser, a memory that persists between conversations, and connections to the apps a person actually lives in. Skills are how it does the work. Meta's Help Center describes them as built-in capabilities, developed by Meta and already part of the agent, things like creating podcasts, generating images, compiling research, and drafting documents. When you ask Muse to do something, it decides which skills the job needs and runs them, with no install step and no store in between.
On September 29, 2026, Meta put skills in a launch headline for the first time, announcing a collection of new skills and connectors inside Muse for Small Business, and the company's security write-up described a skill as detailed instructions to Muse on how to get the most out of each connector. That sentence matters more than the headline, because it draws a line Meta wants you to notice. A connector is a permissioned link between Muse and an outside app, something you authorize. A skill is instructions for completing a class of task, often using one or more connectors. Instructions and access are separate layers, written by different hands, and the launch repeated the promise that ties them together: nothing publishes, sends, or spends without your approval.
What Meta did not announce was any way for you to install your own skill. As of this writing, no install button exists in the consumer Muse app, no upload dialog, and no SKILL.md file you can drop in for good. Independent testing in October 2026 confirmed the gap and found the workaround everyone actually uses: paste the whole SKILL.md file into a chat, and Muse follows it for that conversation. The one documented exception is Muse Code, Meta's developer agent, which reads standard SKILL.md files natively, and everyone else pastes. A skill is not software that plugs into the app. It is context for a conversation, and Muse reads documents the way it reads anything you paste into a chat, then follows the instructions it finds there.
That distinction is where the security story starts, because a skill file is instructions by design, which makes it the ideal container for an attack. Socket.dev put it plainly in its prompt injection glossary: a package README, a tool description, or a SKILL.md file is executable in the only sense the model cares about. Installing an agent skill means asking the model to follow a stranger's text, often alongside scripts the text tells it to run. OWASP ranks prompt injection first in its 2025 Top 10 for LLM applications, and its Agentic Skills Top 10, a whitepaper in public review since August 2026 with version 1.0 targeted for the fourth quarter, puts skill marketplace attacks at the top of its own list. Cisco's open source skill scanner names nine threat categories for agent plugins, from prompt injection and data exfiltration to tool poisoning and hardcoded secrets. None of this is theoretical. February 2026 proved it in bulk.
February proved it, in bulk
Between January 27 and early February 2026, attackers uploaded large numbers of poisoned skills to ClawHub, the public marketplace for the OpenClaw personal agent, disguised as tools for crypto analytics, finance tracking, social media, and auto-updates. VirusTotal analyzed more than 3,016 skills and found hundreds with malicious characteristics, including 314 tied to a single ClawHub user at the time of its February 2 report. Koi Security audited 2,857 skills and found 341 malicious, with 335 of them tied to one coordinated operation it named ClawHavoc. Bitdefender Labs, looking at the same registry in the first week of February, found about 17 percent of the skills it analyzed behaving maliciously, and more than half of those were crypto-themed. By February 16, Koi's count had risen to 824 as the registry passed 10,700 skills. Later analyses pushed the numbers higher still: Antiy attributed 677 malicious skills to the first account and 390 to a second, and counted 1,184 malicious packages in ClawHub's historical repository. Counts differ by source and date, and this article presents them as a range across auditors rather than a single settled number, but every auditor agrees on the shape: one marketplace, one month, hundreds of poisoned files.
VirusTotal's second report, published February 5, documented five skills, each one a distinct technique: Better-polymarket embedded a bash reverse shell that gave its operator interactive remote access as the agent's user; Wake-up was a semantic worm; Evilweather injected an SSH key; Rankaj exfiltrated the contents of the agent's environment file; and Devinism was what the researchers called a cognitive rootkit, instructions that persist inside the agent's reasoning rather than its filesystem. These were not hypotheticals written up by a vendor with a product to sell. They were live listings, downloaded by real users, running on agents that held real credentials.
OpenClaw responded the way a responsible platform should. On February 7 and 8, it announced a partnership with VirusTotal: every skill published to ClawHub would be scanned, including Code Insight, a language model review of the SKILL.md file and everything it references, with benign skills approved, suspicious ones warned, malicious ones blocked, and active skills re-scanned daily. And then OpenClaw said the part that matters most. Scanning is not a silver bullet against concealed prompt injection, because a skill that uses natural language to instruct an agent to do something malicious will not trigger a virus signature. A scanner looks for code, and a skill is words.
May 2026 proved the warning. Palo Alto Networks Unit 42 reported two skills published that month that sent the agent to a paste site hosting an infostealer command, and ClawHub's automated audit returned Pass, or no verdict, for both. OpenSourceMalware reported about forty skills whose files contained no malicious code at all, only a link to a lookalike website that served the command, and because the skill files were clean, file scanning did not catch them. Any scanner that reads only the skill file has the same blind spot when the payload lives elsewhere, and the payload usually lives elsewhere, because a link is easier to swap than a binary and harder to attribute than a hash.
February also produced the case that shows how far a single injection can travel. An attacker placed a prompt injection in the title of a GitHub issue filed against Cline, an AI coding assistant. Cline's issue triage workflow read the title as an instruction and ran an install against an attacker-controlled repository. Its install script poisoned the project's GitHub Actions cache. When the nightly release workflow restored that cache, its npm publishing token was exfiltrated, and on February 17 the token published an unauthorized release of Cline itself, version 2.3.0, whose only change was a post-install hook that silently installed the OpenClaw agent globally. That release was downloaded roughly 4,000 times before it was withdrawn about eight hours later. A GitHub issue title became a software supply chain compromise. Nobody typed a malicious command and nobody clicked a malicious link. An agent read a title and did what titles are for.
The approval gap
Meta's promise is real, and it is narrower than it sounds. Nothing publishes, sends, or spends without your approval gates three verbs. A pasted skill does not need any of them to hurt you. It needs the agent to use capabilities you already approved in the ordinary course of work, reading a file, fetching a URL, summarizing a document, because exfiltration rides an approved capability. A skill that tells the agent to fetch a URL with the contents of an environment file tucked into the query string never triggers an approval dialog, because fetching a URL is not publishing, sending, or spending. Approval guards the exit doors Meta named, while a skill walks out through a window Meta already opened.
Security researcher Simon Willison named the pattern that makes this possible, and it is the most useful lens in this story. An agent is exposed when it has all three of these at once: access to private data, exposure to untrusted tokens, and an exfiltration vector. Muse has all three by design, and so does every personal agent worth using, because the design is the product. It reads your email, your calendar, and your files. It ingests content from outside: web pages, shared documents, tool outputs, pasted files. And it can make outbound requests, call an API, fetch a URL, render an image, post a link. Two 2025 attacks showed the exact mechanic before skills were even the vector. EchoLeak hid an injection in an email the victim never read, and Microsoft's Copilot carried it out. GeminiJack hid instructions in a Google Doc and a calendar invite. Research published this year puts indirect injection, the kind that arrives through content your agent reads rather than text you type, at more than half of observed injection attacks, succeeding 20 to 30 percent more often than direct injection, because it hides inside trusted sources.
Then there is the provenance problem, and it is the simplest fact in this article. A SKILL.md file is plain markdown text, carrying no signature, no publisher identity, no hash, no version attestation, and no revocation mechanism. Nothing in the file can tell you who wrote it, whether the copy you pasted matches the copy the author published, or whether anyone has reviewed it. On a registry with scanning, daily re-scans, and a partnership with VirusTotal, roughly one skill in thirteen was malicious at the February peak, 824 of about 10,700, and that ratio mixes two numbers from the same reporting window rather than a single published figure, so treat it as an approximation, not a census. A pasted file from X or a blog has none of that scanning at all. Pasting is the least protected way to install the most privileged thing an agent can load, and it is the only way Muse users have.
The other side, at full strength
Fairness demands the strongest version of the case against all of this, stated at full strength and not strawmanned, and it is stronger than the security community usually admits. Pasting is also the only way Muse users can teach the agent a repeatable workflow today, and the documented cases are mostly from OpenClaw's open marketplace, not from Muse itself. Meta's skills are Meta-authored. Muse has no skill marketplace. Its approval flow does catch the consequential actions, the sends and the spends, and no verified case exists of a pasted SKILL.md compromising a Muse user. Treating a paste as an install overstates the risk in three ways. A pasted skill lasts one conversation. You can read the file before pasting it, because it is plain text and not a binary. And the file cannot do anything your agent cannot already do, which means the risk is bounded by permissions you already granted, not by permissions the skill invents. On this reading, the ClawHub numbers describe a different agent with a different trust model, an open registry where anyone can publish, and they say nothing about a closed agent where every skill ships from Meta. The honest version of this story is that the risk is real but unproven on Muse specifically, and the burden of proof runs the other way for a publication making a security claim. That argument deserves to be heard in full before anyone changes how they use their agent, and it is not answered by pointing at another company's incident log.
It is also incomplete, because it assumes the user reads the file, and almost nobody does. A skill pack shared as ten roles in a social post is consumed the way a recipe is consumed, copied whole and tried once, and the file that looks like a marketing brief can carry instructions the reader never reaches, because the instructions sit below the fold, or in a referenced script, or behind a link. One conversation is enough when the conversation holds your inbox. And the bound that matters is not what the skill can invent but what the agent can already reach, which is everything. A closed agent with Meta-authored skills is safer than an open registry, and that safety ends the moment you paste a file Meta did not write into a conversation Meta cannot see, because at that moment you have built your own registry of one, with no scanning, no daily re-scan, and no second reviewer. You are the marketplace now. Act like it.
What I could not verify
Honesty requires stating the gaps plainly, and the largest comes first. No verified case of a pasted SKILL.md compromising a Muse user exists in the public record, and the ClawHub incidents involve OpenClaw, a different agent framework, so the mechanism transfers and the incidents do not. Meta has not published a per-skill list, a skill review process, or any statement about whether pasted workflows are scanned or sandboxed, and the Help Center says only that skills are built in. Counts differ across auditors, as noted, and should be read as a range. The approval gap described here is an analysis of Meta's stated policy against documented exfiltration techniques, not a demonstrated exploit against a live Muse agent, and I did not test a malicious skill against one. What follows is a protocol for a risk that is documented elsewhere and plausible here, and it should be read that way, not as a report of an incident that has already happened on Muse.
How to paste a skill without handing over the keys
First, read the file before you paste it. It is plain text, and that is the one advantage you have over every other software install. Open it, read all of it, and read anything it references. If the file is longer than you will read, do not paste it. Second, refuse any skill that fetches a URL, runs a script, or reads a file you would not hand to a stranger, because those are the three moves every documented malicious skill used, and a marketing brief has no legitimate reason to do any of them. Third, paste into a fresh chat with nothing connected that the skill does not need, and treat that chat as contaminated until you have seen what the skill actually did. Fourth, check the Activity log after the skill runs, because Meta built the log for exactly this, a record of what skills were used, and it only helps if someone looks. Fifth, prefer the built-in skills and the Goals tab over pasted files whenever the job allows it, because a Goal is an instruction you wrote, and a pasted skill is an instruction someone else wrote, and that difference is the entire article.
Your agent holds your inbox, your calendar, your files, and the keys to your accounts, and it will follow a brief the way a good assistant follows a brief, which is completely and without asking whether the brief is yours. Read the file, then paste it, because that order is the whole security model, and right now you are the only part of it that works, which is a strange place for a security model to live, in the hands of the person it is supposed to protect, with no backup and no second check.