An MCP registry is a phone book, not a background check

Here is a sentence that should bother you more than it does. When an AI agent goes looking for a new capability, it usually finds it in a registry, reads the skill's own description of itself, and installs it. The description is written by whoever published the skill. The agent treats it like a fact.

In May 2026, three researchers put numbers on exactly how bad that is. Their paper, "Under the Hood of SKILL.md," ran real skills from a live registry through the ordinary registry machinery: search, selection, and the safety check that is supposed to block the bad ones. The finding is not that agents get hacked by clever code. It is that the natural-language text in a skill file, not the code, decides what agents find, pick, and trust. Reword a malicious skill to sound helpful and it reached the top ten of the agent's search results about 80 percent of the time. Given two skills that did the same job, the agent chose the adversarially worded one 77.6 percent of the time, on the description alone. And a malicious skill using semantic evasion slipped past a blocking verdict in anywhere from 36.5 percent to 100 percent of cases.

Read that last range again. Sometimes the safety gate caught nothing.

What an MCP registry actually is, and what it is not

Strip away the branding and a registry is a phone book. It is a directory that answers one question: does a listing for this thing exist. It does not answer whether the thing works, who really wrote it, or what it does once it runs. If you want the fuller breakdown of how skills, plugins, and MCP servers fit together, we wrote that up separately, but the short version is that a registry is the distribution layer, the shelf, not the inspector.

That distinction did not matter much when a human was in the loop. You searched a directory, eyeballed a few options, and used your own judgment before installing anything. The judgment was the safety system, and the registry was just the shelf.

Agents changed the shape of that. An agent now does the searching, the choosing, and the installing on its own, in one motion, faster than you can read the README it is trusting. The registry is no longer a shelf a careful person browses. It is the trust boundary, and the research above shows that boundary is decided by marketing copy.

The registry can be gamed at every step

The useful thing about the SKILL.md study is that it did not test one exploit. It tested the whole pipeline, stage by stage, and the registry leaked at each one.

Discovery. Registries surface skills by matching your request against each skill's description using embeddings. That means the words in the description are the ranking signal. Short, deliberately chosen trigger phrases pushed an adversarial skill into the top ten roughly 80 percent of the time. The skill did not get better. Its copywriting did.

Selection. Once a few candidates are on the table, the agent picks one. Framing alone, the way a description is worded, biased the agent toward a functionally equivalent malicious variant 77.6 percent of the time. Two skills, same job, and the agent reached for the one that described itself more persuasively.

Governance. This is the part that should end the "we have a scanner, we are fine" conversation. A registry that runs an automated review to block bad skills was evaded by semantic tricks in 36.5 to 100 percent of cases, depending on the technique. A check that a determined description can talk its way past is a suggestion, not a gate.

None of that required a zero-day. It required knowing that the agent reads the label and believes it.

"Listed" and "starred" and "verified" are attention, not review

Every registry wants to brag about its number of listings, and a badge or a star count feels like a signal. It measures attention. It does not measure whether anyone opened the file.

Start with who is allowed to publish. On most public registries, the answer is anyone with an account. Skills are rarely signed, rarely reviewed, and rarely run by a single human before your agent finds them. The barrier to listing is a pulse. So the population you are searching is not curated, it is accumulated.

The scale is the other half of the problem. One 2026 paper, SkillSieve, studied 49,592 real skills from a single registry and had to build an automated triage pipeline to do it, because a human reviewing tens of thousands of skills by hand is not a plan, it is a resignation letter. A second paper, SkillFortify, catalogs what happens when nobody is reading: the ClawHavoc campaign pushed more than 1,200 malicious skills into one marketplace over a few weeks in early 2026, and a separate effort catalogued 6,487 malicious tools built specifically to evade conventional detection. Different studies, different numbers, same direction. The shelf is full and mostly unattended.

A star count cannot tell you who wrote a skill, whether it runs, or what it touches when you are not watching. Those are the only three questions worth asking, and the listing page answers none of them. A skill that grades where code actually came from can do the provenance pass for you, but the point stands: the badge is not the check.

Why this is a distribution problem, not a scanner problem

It is tempting to respond to all of this by bolting a better scanner onto the registry. The governance numbers above are the reason that does not save you. When the thing being reviewed is text, and the reviewer is also reading text, a sufficiently well-written description can aim itself at both the agent and the scanner at once. You cannot fully out-scan a channel whose entire job is to accept anything anyone uploads and describe it in the publisher's own words.

The honest fix is upstream, at distribution. Decide what goes on the shelf before it goes on the shelf. That is a different posture than an open registry. An open registry optimizes for how much it can list. A curated catalog optimizes for what it is willing to vouch for, which is a much smaller and much more useful number.

What a checked catalog does instead

This is the entire reason ClearPoint Nexus exists, so we will be direct about it. A certified catalog inverts the order. Nothing lists until it has been read.

Concretely, our certification pass runs 96 checks across structure, platform fit, and quality, plus a separate 7-dimension security scan, and a skill has to clear all of it on every supported platform before it appears. The 96 and the 7 are two different things and we keep them that way: the 96 are pass-or-fail checks that ask whether a skill is real, whether it fits each platform's contract, and whether its output is worth anything, and the 7 are a security scan that reads for the exact class of problem the registry research describes, including instructions hidden in text the agent is meant to trust. If you want the layer-by-layer version of what that certification actually checks, it is its own post.

The part that matters for this conversation is the ordering. On an open registry, a skill is listed and then, maybe, someone looks. In a certified catalog, someone looks and then it is listed. A new batch clears certification each month and lands only after it passes. That is not a scanner competing with a clever description after the fact. It is a decision about the shelf.

The boring conclusion

This is not a reason to panic or to swear off skills. Skills are genuinely useful, and agents finding their own tools is genuinely powerful. It is a reason to notice that the registry your agent pulls from is a phone book, and to stop treating a phone book listing as a reference check.

The research this month made the failure legible. The words in the file, not the code, decide what your agent finds and trusts, and an open registry passes those words straight through. The fix is unglamorous: somebody reads the skill before it lists, so you do not have to audit a stranger's code before installing a text file. Boring, on purpose. In a month where researchers showed how easily a listing can lie, boring is the whole product.

Sources

• Shoumik Saha, Kazem Faghih, Soheil Feizi, "Under the Hood of SKILL.md: Semantic Supply-chain Attacks on AI Agent Skill Registry," arXiv:2605.11418, submitted 12 May 2026.
• Yinghan Hou, Zongyou Yang, "SkillSieve: A Hierarchical Triage Framework for Detecting Malicious AI Agent Skills," arXiv:2604.06550, revised 27 July 2026.
• Varun Pratap Bhardwaj, "Formal Analysis and Supply Chain Security for Agentic AI Skills," arXiv:2603.00195, submitted 27 February 2026.