LLM Agent Skills Leak Credentials in 520 Tools, Study Finds

Security vulnerabilities in AI agent extensions

Third-party skills that extend the capabilities of AI agents are leaking sensitive credentials at an alarming rate, according to new research from Wake Forest University. The study examined over 17,000 randomly selected skills from the largest open-source AI agent skill marketplace and uncovered significant security problems.

Ying Zhang, an assistant professor in Wake Forest's Department of Computer Science, led research that identified 520 affected skills containing 1,708 distinct security issues. Nearly 90% of the leaked credentials could be exploited immediately by attackers.

The research focused on skills—reusable software extensions that give LLM agents like Claude Code, Codex, or Cursor new capabilities such as database access or domain-specific analysis. These skills are installed by developers to help autonomous AI systems perform specialized tasks, from creating presentations to scanning financial documents.

Two paths to credential exposure

Zhang's team identified two primary ways credentials become vulnerable through AI agent skills:

Malicious design: Developers intentionally build skills with instructions to steal credentials and exfiltrate private data to remote servers.

Unintentional flaws: Developers use insecure coding practices that inadvertently expose credentials and data to exploitation.

"When the agent skill is flawed or developed with malicious intent, it will steal your data and maybe pass it back to a remote server to be used in some malicious way," Zhang said.

The researchers analyzed skills from SkillsMP, which provides access to more than 1.6 million skills. From 17,022 randomly selected skills, the team generated 170,226 outputs and discovered 10 distinct leakage patterns. After the researchers reported their findings, SkillsMP removed all malicious skills and fixed most vulnerabilities stemming from negligent coding.

Why it matters

The findings arrive as AI-assisted development accelerates and more amateur developers enter the field through practices like "vibe coding." Zhang argues this makes the security gap more dangerous: inexperienced developers lack security knowledge and cannot rely on AI tools to address security concerns automatically. The research highlights a fundamental problem in software development—security is treated as an afterthought rather than integrated from the initial design stage. With AI agents increasingly handling sensitive credentials and private data, the cost of this approach grows steeper.

The path forward

Zhang advocates for security to be embedded in software design from the start, not bolted on after breaches occur. She calls for researchers to establish data safety standards that AI developers must meet, automated tools to analyze AI agent skills for vulnerabilities, and regulatory frameworks or contractual assurances that downloaded applications meet security requirements.

"When I train my students, I teach them that security is a critical component in their software design," Zhang said. "Every feature they develop, they have to keep security in mind."

Zhang will present the research at the International Conference on Automated Software Engineering in Munich, October 12-16. The findings were first reported by Wake Forest University.