Snyk Finds Malware Behind a 650,000-Star Skills Boom

Three GitHub repositories that package step-by-step instructions for AI coding agents have drawn a combined 651,053 stars as of Sept. 19, 2026, according to GitHub's own API: obra/superpowers at 288,711, mattpocock/skills at 265,602 and addyosmani/agent-skills at 96,740. Two pieces of research published in February 2026 raise separate questions about what that growth is actually buying developers.

How addyosmani/agent-skills grew to 96,740 stars

Addy Osmani published Agent Skills on May 3, 2026, when it had 27,000 stars, according to the post itself. Osmani, now a member of technical staff at Anthropic working on Claude Code, wrote that "a senior engineer's job is mostly the parts that don't show up in the diff" and that "AI coding agents skip those parts by default. Agent Skills is my attempt to make them not optional." The MIT-licensed package ships 20 skills across six workflow phases, from spec-writing to shipping, installable in Claude Code with a single /plugin marketplace add command.

That is a fraction of what the two largest packages in the category now hold. obra/superpowers, created Oct. 9, 2025 by developer Jesse Vincent, whose company is listed on GitHub as Prime Radiant, and mattpocock/skills, created Feb. 3, 2026 by TypeScript educator Matt Pocock of Total TypeScript, have each passed a quarter-million stars, dwarfing the count Osmani had when his own post went up.

1. obra/superpowers289K stars
2. mattpocock/skills266K stars
3. addyosmani/agent-skills97K stars

Source: GitHub API, accessed Sept. 19, 2026

Why agent skills security lagged the growth curve

Snyk's ToxicSkills research, published Feb. 5, 2026, scanned 3,984 skills pulled from the ClawHub and skills.sh marketplaces, not from the three repositories above. It found 1,467 skills, 36.82 percent, carried at least one security flaw, and 534, 13.4 percent, had a critical one. Of those, 76 contained confirmed malicious payloads, and eight remained live on ClawHub at the time Snyk published.

Snyk, whose researchers on the report include Luca Beurer-Kellner and Liran Tal, wrote that 100 percent of the confirmed malicious skills contained conventional malware patterns while 91 percent simultaneously used prompt injection, a combination the report says defeats both AI safety filters and ordinary malware scanners at once. One documented example decodes a base64-encoded shell command that reads local AWS credentials and posts them to an attacker-controlled endpoint. Snyk named three of the skills it flagged: clawhub.ai/zaycv/clawhud, polymarket-traiding-bot and moltbook-lm8. Daily skill submissions to the marketplaces went from under 50 in mid-January 2026 to more than 500 by early February, a tenfold jump in a few weeks that outpaced any review process Snyk could identify. Not every skill on a marketplace is unreviewed: Cloudflare's own security-audit skill went through a rival's blind test this month, the kind of outside scrutiny the ClawHub long tail mostly has not received.

What the ETH Zurich study says about a related file

A second paper, posted to arXiv on Feb. 12, 2026, examined a related but distinct artifact: repository-level context files like AGENTS.md and CLAUDE.md, not the packaged SKILL.md instructions Snyk scanned. Researchers Thibaud Gloaguen, Niels Mündler, Mark Müller, Veselin Raychev and Martin Vechev, working out of ETH Zurich and LogicStar.ai, tested four coding agents, Claude Code with Sonnet-4.5, Codex with GPT-5.2 and GPT-5.1 mini, and Qwen Code with Qwen3-30B, against SWE-bench Lite and a second benchmark called AGENTbench.

Study	Scope	Headline finding
Snyk ToxicSkills, Feb. 5, 2026	3,984 skills scanned from ClawHub and skills.sh	1,467 skills (36.82%) carried a flaw; 76 held confirmed malicious payloads
ETH Zurich AGENTS.md study, Feb. 12, 2026	4 agents across SWE-bench Lite and AGENTbench	LLM-written context files cut task success up to 2%; hand-written files cost 19-23% more for a 4% gain

The paper's conclusion reads plainly: "LLM-generated context files have a marginal negative effect on task success rates, while developer-written ones provide a marginal performance gain." Every context file tested, generated or hand-written, added roughly 20 percent to inference cost regardless of whether it helped.

What neither study checked

Neither report scored obra/superpowers, mattpocock/skills or addyosmani/agent-skills directly for either malware or task performance; Snyk sampled the long tail of a marketplace, and the ETH Zurich team tested context files rather than packaged skills. The distinction matters less to a developer than it should: both formats are markdown a coding agent reads and follows without a compiler checking it first, which is exactly the property Snyk's malicious examples relied on.

Snyk has since built a response into the pipeline rather than leaving it as a report. On March 17, 2026, it partnered with Tessl to run every skill submitted to the Tessl Registry through its Batch Skill Analysis API, a scan Snyk says typically finishes in 5 to 15 seconds and surfaces a security score before a developer installs anything. "Skills are quickly becoming a new unit of software, executed by the agent," said Guy Podjarny, founder and chief executive of Tessl. "By integrating Snyk directly into the Tessl Registry and CLI, we're making security visible."

That scanner covers what gets submitted to one registry going forward. It does not retroactively vet the 3,984 skills Snyk already sampled from ClawHub and skills.sh, and it says nothing about whether the three biggest names in the category actually make an agent write better code, the question the ETH Zurich team asked and answered with a number developers may not like: negative.