The Skill Marketplace Blind Spot: Why Your AI Coding Agents Are Leaking Credentials in Plain Sight

Your AI coding agent can now install a “skill” the same way you’d install an npm package — a bundle of instructions and code that teaches it to file Jira tickets, query a database, or drive a CI pipeline. It’s a genuinely useful idea, and it’s spreading fast: the largest open-source skill marketplace, SkillsMP, already indexes hundreds of thousands of these packages, compatible with Claude Code, OpenAI’s Codex CLI, and ChatGPT alike. What almost nobody was checking, until now, is whether those skills are quietly handing your credentials to whoever wrote them.

A large-scale empirical study from researchers at Wake Forest University, Griffith University, Nanyang Technological University, and six other institutions — accepted to ASE 2026, one of the top venues in automated software engineering — sampled 17,022 skills from SkillsMP and found that 520 of them leak credentials, through 1,708 distinct security issues. Nearly 90% of those leaks were immediately exploitable, no privilege escalation required. This post covers what the study actually found, why the leaks happen at the architectural level rather than through obvious carelessness, and what to change in how your organization vets and runs third-party AI agent skills.

What the Study Actually Found

The researchers didn’t go looking for a handful of bad actors — they ran a systematic scan across a random sample of 17,022 skills, drawn from a pool of 170,226 artifacts on SkillsMP. Roughly 3% of sampled skills — 520 of them — contained at least one of ten distinct credential-leakage patterns the team catalogued, totaling 1,708 separate issues.

The severity is the part worth sitting with: 89.6% of the leaked credentials were immediately exploitable without any additional privileges. This isn’t a theoretical weakness that requires chaining several exploits together. In most cases, a leaked API key or token in a skill’s logs, output, or source was usable as-is by anyone who found it.

Most of these skills weren’t written by attackers. The paper attributes roughly 84% of the affected skills to developer negligence rather than malicious intent — the same kind of hardcoded-secret mistakes that have plagued conventional software for decades, just now happening inside a newer, faster-moving, far less scrutinized packaging format. We’ve written before about how agent plugins and skills don’t yet port cleanly between AI coding tools — this study is a reminder that portability isn’t the only unsolved problem in this ecosystem. Security review hasn’t caught up either.

Why the Leaks Happen: The stdout-to-Context Problem

The single largest cause wasn’t hardcoded secrets sitting in plain sight in source files, though that happens too. It was something more structural: 73.5% of all vulnerability issues (1,007 of 1,371) came from debug logging via print or console.log statements, according to the paper. The mechanism is specific to how agent frameworks work — they capture a skill’s stdout output and feed it back into the LLM’s conversation context, so the agent can reason about what just happened and decide what to do next.

That’s a reasonable design choice for debuggability. It’s also a direct pipeline from “credential a developer logged for troubleshooting” to “credential now sitting in the agent’s context window, retrievable through nothing more sophisticated than asking the agent about it in plain English.” A secret that would have been invisible to an attacker scanning a repository for AWS_SECRET_KEY= becomes trivially retrievable once it’s inside a conversational memory the agent will happily summarize on request.

This is a genuinely different threat model from classic secret-scanning, which is built to catch credentials sitting in code or config files — not credentials that only become exposed at runtime, after being funneled through a logging statement into an LLM’s working memory. Static secret scanners at publish time won’t catch this pattern unless they’re specifically taught to flag logging calls, not just credential-shaped strings.

The AI-on-AI Feedback Loop

Here’s the finding that should give any engineering leader pause: of the skills with hardcoded credentials, 71.96% showed direct evidence of AI-assisted development — commit messages referencing Copilot, Claude, or ChatGPT — meaning the insecure pattern wasn’t just missed by a human reviewer, it was very often generated by an AI coding tool in the first place.

That tracks with independent data. GitGuardian’s State of Secrets Sprawl 2026 report found that commits made with Claude Code assistance had a 3.2% secret-leak rate, roughly double the 1.5% baseline across all public GitHub commits — and that 28.65 million new hardcoded secrets landed in public GitHub commits in 2025 alone, a 34% year-over-year increase. AI coding tools are shipping code faster than ever, and that includes shipping the same insecure patterns faster than ever. The skill marketplace study is the sharpest illustration yet of what that looks like once the code in question is something an autonomous agent will actually execute with real credentials attached, not just a snippet sitting in a repo.

Not Just Sloppy Code

The negligent 84% isn’t the whole story. The researchers identified roughly 83 skills built with deliberate malicious intent — designed to exfiltrate credentials to a remote server rather than leak them by accident. More than a third of those malicious skills (37.3%) combined multiple techniques in the same package, such as Base64 obfuscation paired with reverse shells, specifically to survive casual review. As Wake Forest’s Ying Zhang, one of the paper’s authors, put it: “When the agent skill is flawed or developed with malicious intent, it will steal your data and maybe pass it back to a remote server to be used in some malicious way.” After the team disclosed its findings, SkillsMP removed the malicious skills and fixed most of the negligently coded ones — but that cleanup happened only because researchers went looking. Nothing in the marketplace’s normal publishing flow had caught it first.

What Kind of Credentials Are at Risk

Looking at the hardcoded-credential cases specifically, the paper’s breakdown skews toward the credentials that matter most for lateral movement: 29.7% were API keys, 24.5% were authentication tokens, 19.7% were passwords or other secrets, and 8.8% were OAuth credentials. In other words, this isn’t mostly low-value test data — it’s the same class of credential that, in a conventional breach, would let an attacker pivot from “found a leaked string” to “authenticated as your service into your actual systems.”

What Enterprises Should Actually Do About It

None of this means the answer is banning agent skills — the productivity case for them is real, and the horse has left the barn. It does mean treating them with the same rigor you’d apply to any third-party dependency with execution privileges, which most organizations currently aren’t doing.

Treat the skill marketplace like your open-source supply chain

If your engineering org runs software composition analysis on npm or PyPI dependencies, extend the same discipline to agent skills before they’re installed, not after. A skill is code with credential access, and it deserves the same pre-install scrutiny as any other third-party package — arguably more, since it runs with an agent’s ambient permissions rather than in a sandboxed build step.

Sanitize stdout before it reaches the LLM’s context

The paper’s own recommendation to framework designers is specific: extract recognized credential patterns from a skill’s stdout stream before it enters the agent’s conversational memory, not after. If you’re building or configuring internal agent tooling, this is the single highest-leverage control point — it addresses the 73.5% failure mode directly, at the layer where the leak actually becomes exploitable, rather than relying on every skill author to avoid logging secrets in the first place.

Fold this into your AI agent governance program, not a separate checklist

This is a specific, concrete instance of the broader gap we’ve covered in the AI-SPM funding boom: most organizations can’t yet say with confidence what their agents can access or what they’re doing with it at runtime. Skill-level credential scanning belongs inside that same governance program — inventory which skills are installed, what credentials each one can reach, and whether its output is being captured into a context window anyone (or anything) can query. The action-layer governance approach we’ve argued for — controlling what an agent is actually permitted to do, not just what it was instructed to do — applies just as directly to a misbehaving skill as it does to a misbehaving agent.

Push vendors and marketplaces for pre-publication scanning as a gate, not a courtesy

The researchers’ clearest ask of the ecosystem is that marketplaces make secret scanning “a mandatory gate rather than an optional hardening step” before a skill is ever listed. If your organization builds or curates an internal skill catalog for employees, apply that same gate internally — don’t rely on a public marketplace’s after-the-fact cleanup to be your security control.

The Takeaway

The uncomfortable pattern in this study is that the leaks aren’t concentrated in a few obviously malicious packages — they’re baked into how agent frameworks are architected, and amplified by the same AI coding tools organizations are racing to adopt. A credential logged for debugging purposes was never a real vulnerability until an agent started reading its own stdout back as conversation. Fixing that means treating agent skills as a supply-chain risk with its own controls: scan before install, sanitize output before it reaches the model, and bring skill-level visibility into whatever AI governance program you’re already building. The organizations that get burned by this won’t be the ones running zero AI agents — they’ll be the ones who assumed a skill from a public marketplace had already been checked.

Frequently Asked Questions

What exactly is an “agent skill,” and how is it different from an MCP server?

A skill is a self-contained package of instructions and code — typically described in a SKILL.md file — that an AI coding agent can install to gain a new capability, similar to a plugin. The study covered here focused specifically on this skill-packaging format on the SkillsMP marketplace, which is compatible with tools like Claude Code, OpenAI’s Codex CLI, and ChatGPT, rather than the separate MCP server ecosystem.

Were these credential leaks mostly the result of hacking, or mostly mistakes?

Mostly mistakes. The study attributes roughly 84% of the 520 affected skills to developer negligence — patterns like hardcoded secrets or debug logging — rather than deliberate malicious design. Around 83 skills were built with clear malicious intent to exfiltrate data.

How can a credential leak through a simple print or console.log statement?

Agent frameworks typically capture a skill’s console output and feed it back into the AI agent’s conversation context so it can reason about what happened. If a developer logs a credential for debugging, that credential ends up inside the agent’s working memory, where it can be retrieved just by asking the agent about it in natural language — no separate exploit required.

Does this mean we should stop using AI agent skills entirely?

No — the practical response is to govern them like any other third-party code with credential access, not to avoid them. That means pre-install scanning, output sanitization at the framework level, and folding skill-level risk into your existing AI agent governance and security program rather than treating skills as inherently safe because they came from a popular marketplace.

Is this problem specific to one AI vendor or coding tool?

No. The marketplace studied is compatible with multiple agent platforms, and the supporting GitGuardian data on AI-assisted commits leaking secrets covers the broader AI coding tool landscape, not a single product. The pattern is architectural — how frameworks handle skill output — rather than a flaw unique to any one company’s tooling.

What’s the single most effective fix an organization can make right now?

Sanitizing a skill’s stdout output for credential patterns before it ever reaches the LLM’s context window addresses the largest failure mode identified in the study — 73.5% of all issues came from exactly this pathway. It’s a framework-level control that doesn’t depend on every third-party skill author getting security right on their own.

Sources

• How Your Credentials Are Leaked by LLM Agent Skills: An Empirical Study - The academic paper (ASE 2026) with the full methodology and figures cited throughout this post
• AI agents are all the rage, but research shows they leak private data - Wake Forest University’s coverage, including direct quotes from co-author Ying Zhang
• AI agents are all the rage, but research shows they leak private data - TechXplore’s syndication of the same findings and interview
• The State of Secrets Sprawl 2026 - GitGuardian’s annual report, source for the Claude Code commit secret-leak-rate comparison
• Zenity Raises $125 Million to Secure the Era of 1 Billion AI Agents - Background on the AI-SPM funding wave referenced in this post’s governance recommendations
• Gartner Predicts 40% of Enterprise Apps Will Feature Task-Specific AI Agents by 2026 - Context on how fast agent adoption is outpacing governance