A dangerous misconception: “MCP makes skills safe”

Some people assume the Model Context Protocol layer makes this safer, because tools can be exposed through a structured interface, with explicit user consent and authorization controls depending on the host and server implementation. But skills do not need to use MCP at all. The Agent Skills specification places no restrictions on the markdown body, and skills can include whatever instructions will “help agents perform the task,” including copy and paste terminal commands. And skills can also bundle scripts alongside the markdown, which means execution can happen outside the MCP tool boundary entirely. So if your security model is “MCP will gate tool calls,” you can still lose to a malicious skill that simply routes around MCP through social engineering, direct shell instructions, or bundled code.

MCP can be part of a safe system, but it is not a safety guarantee by itself. Just as importantly, this is not unique to OpenClaw. “Skills” are increasingly portable because many agents are adopting the open Agent Skills format, in which a skill is a folder centered on a SKILL. md file with metadata and freeform instructions, and it can also bundle scripts and other resources. Even OpenAI’s documentation describes the same basic shape: a SKILL.

md file plus optional scripts and assets. That means a malicious “skill” is not just an OpenClaw problem. It is a distribution mechanism that can travel across any agent ecosystem that supports the same standard.