SkillJacking Is Real. I Built the Pinning Layer Skills Were Missing.

Description and use

SkillJacking exposed the lack of integrity checks for skills, enabling attackers to replace them with malicious versions. The skill‑pin‑verify tool records skill hashes, verifies them before installation, and audits contents for dangerous patterns, protecting agents from tampered skills.

Problem

Skills lack lockfiles, signatures, and pinning, enabling attackers to hijack skill listings and deliver malicious code to agents.

Outcome

Skill-pin-verify prevents installation of hijacked skills by enforcing SHA-256 pinning and auditing for high‑severity malicious patterns, reducing risk of malicious code execution in agents.

Workflow

• Record a pin for a trusted skill using skill-pin-verify record <url> --name <name>
• Verify a skill before installation with skill-pin-verify verify <url> --pin <sha256>
• Audit any skill directory or tarball with skill-pin-verify audit <path> --strict

Evidence

Agents install skills the way we install packages — except skills have no lockfile, no signature check, no pinning.

Source

SkillJacking: hijacking skill listings on a popular marketplace so agents installing them executed attacker-controlled instructions.

Source

925 skills hijacked from their maintainers, affecting 134K agents

Source

I built skill-pin-verify to close that gap: a stdlib-only Python CLI that treats skill tarballs like artifacts worth pinning.

Source

verify downloads the tarball, compares its SHA-256 against your pin, then extracts it safely and audits the contents.

Source