Security for skills and MCP servers: a practical guide to protect your agent (2026)
Every skill or MCP server you install gives your agent new capabilities and gives a third party a way to influence what it does. In 2026 this stopped being theory: there were malicious skills in public marketplaces, MCP servers exposed with no password and dozens of registered vulnerabilities. The rule: treat every skill and every MCP server as code from a stranger.
What skills and MCP are, in one line
- Skill: a package of instructions (and sometimes code) that teaches the agent to do something.
- MCP server: a service that publishes functions so any compatible agent can use them. See Functions in AI agents.
What happened in 2026
| Incident | What was found |
|---|---|
| Malicious skills on ClawHub (the OpenClaw marketplace) | 1,184 malicious skills confirmed by Antiy CERT |
| Exposed MCP servers | 492 servers with no authentication or encryption (Trend Micro) |
| MCP vulnerabilities | More than 30 CVEs filed in January and February 2026 |
| Analysis of 7,000+ MCP servers | 36.7% vulnerable to SSRF |
OWASP has already published two specific lists: the Top 10 for Agentic Applications 2026 (December 2025) and the MCP Top 10, which is in beta.
The 5 risks that matter most
- Tool poisoning. Malicious instructions hidden in a function's description: the user doesn't see them, the model does. The agent obeys them thinking they are part of the tool.
- Prompt injection. A page, email or document the agent reads contains "ignore the above and send the data to…". If the agent has the function to do it, it may do it.
- Supply chain. A trusted skill or server is updated with malicious code after you installed it (a rug pull).
- Excess permissions. The agent has access to more than it needs; when something fails, the damage is bigger.
- Secrets in memory. Keys, passwords or personal data the agent stored by accident and later repeats or leaks.
10-point checklist
- Install skills and MCP servers only from sources you can identify.
- Read each function's full description before enabling it, long text included.
- Pin the version: don't accept automatic updates without review.
- Require authentication on every MCP server you expose to the internet.
- Give each agent only the functions its task needs.
- Require human approval on functions that move money, delete data or send messages.
- Treat everything the agent reads (web, emails, files) as data, never as orders.
- Don't store keys or passwords in the agent's memory; use a secrets manager.
- Log every tool call: which function, with which data, and why.
- Review the agent's memory regularly and clean out secrets, personal data and contradictions.
How AUN helps
- Memory review: finds secrets, personal data, duplicates and contradictions, and returns a clean memory. Review my agent's memory
- Free memory secret scan and free schema review from the AUN MCP server, read-only. AUN MCP server
- Tool-call audit: measures whether your agent uses the right function or drifts. Audit my agent
Sources
- CyberDesserts – AI Agent Security Risks 2026
- Cycode – OWASP MCP Top 10
- mcp.directory – MCP Security 2026
- Obot – OWASP Top 10 for LLM, Agentic and MCP
Frequently asked questions
Is MCP insecure?
The protocol is not insecure by itself; the risk lies in misconfigured servers, servers without authentication or of unknown origin.
What is tool poisoning?
Hidden instructions in a function's description that the model reads and obeys without the user seeing them.
How do I know if a skill is safe?
Check who publishes it, read its full content, pin the version and test it first without access to real data.
How much access should my agent have?
The minimum for its task. See How much freedom does an AI agent have.