SkillFortify documents a real campaign that pushed 1,200+ malicious skills into a public marketplace.

The ClawHavoc campaign deployed the AMOS credential stealer through a skill marketplace, and the paper proposes capability-based sandboxing with a confinement proof plus a trust-score algebra (arXiv:2603.00195). An installed skill is executable third-party code sitting next to your credentials. We solved this for package managers with lockfiles, signatures, and scanning. The skills ecosystem has none of it yet. Confine by declared capability, gate on a trust score, stop running things because the README sounded nice.