The Missing Dependencies Hidden Inside AI Agent Skills and Plugins

Skills and plugins give coding agents new capabilities, from reviewing code to working with cloud tools. As developers adopt them, they also bring someone else’s instructions, scripts, and tooling choices into their workflow.

We wanted to understand the risks those capabilities introduce. How do instructions from a skill influence an agent’s decisions? What commands might it execute, and what access might those commands have?

To understand those risks, let’s start with what skills and plugins are.

What Are Skills and Plugins?

A skill gives a coding agent instructions and resources for completing a task. A plugin bundles capabilities such as skills, MCP servers, and more.

Skills can come from companies - for example, Google’s Stitch skills help agents work with its design tools, while Anthropic’s document skills support tasks involving PDFs, spreadsheets, and presentations. Your organization can write skills for internal workflows, independent developers share them on GitHub, and you can write your own.

Where We Looked

Directories bring these distributed resources together. For our investigation, we used Claude Code Marketplaces to discover agent assets and follow their listings to the source repositories.

We examined the instructions and commands those assets introduce into an agent’s context, looking at the actions they could trigger and the risks they could bring into a developer’s environment.

Claude Code Marketplaces, our starting point for the scan.

How We Investigated

We ran multiple custom Bluebear scanners across agent assets listed in online marketplaces, looking for application security risks in their instructions, commands, package references, and links to external sources.

Early in the scan, we found something unexpected: a widely used plugin referenced a package that didn’t exist.

At first, we suspected a typo. But as the scans continued, similar findings appeared across more repositories: plausible-looking package names with no corresponding package on the registry.

What initially looked like an isolated mistake became a recurring pattern. Reusable instructions were telling agents to install software that wasn’t there.

What We Found

Our scan identified 72 affected agent assets across 45 repositories:

• 45 standalone skills and 27 plugin-bundled skills.
• 50 npm, 18 PyPI, and 4 Cargo missing package references.
• 69,520 combined GitHub stars across the repositories - a measure of visibility, not affected users.

How the Risk Works

We found missing package references, not evidence of an active attack. If a referenced name is available to register, an attacker could publish a malicious package under that name.

One real example of an agent hallucination produced an instruction to install a nonexistent package:

npm install ai-brainstorm-design

While the package is missing, the command fails. After an attacker publishes it, the same command could retrieve attacker-controlled code.

The skill and its repository would remain unchanged. An agent following the same instructions could now download an attacker’s package.

The malicious package may not exist when you review the skill. It can appear afterward.

What To Check

• Review the commands, scripts, and external sources a skill references.
• Verify that packages exist and belong to the intended publishers.
• Limit the credentials, files, and systems available during execution.

Responsible Disclosure

We are coordinating disclosure with maintainers and marketplace operators, giving them an opportunity to correct affected references before attackers exploit them. We are not publishing affected repository names.

Bluebear Recommendation

Know and scan your agentic assets, including skills, plugins, and MCP servers: their capabilities can also introduce risks. Bluebear scans your organization’s assets for common security issues and risks uncovered by our research.