Selected Agent Skill Security Resources (November 2026)

Adversa AI released the first Agent skill security resource compilation for November 2026, containing 17 resources, of which 8 are attack techniques and 4 are defenses. The compilation states that the common thread of October research is compositional risk: skills that each pass review still trigger violations when combined, and graph analysis found 612 unsafe combinations among 13,598 clean ClawHub skills. Among them, OpenAI's official render-deploy skill pointed a private Render service to the unregistered domain render-internal.com; after that domain was registered as a sinkhole, a production application sent token-bearing calls to it. Render has now removed the reference and taken over the domain, and OpenAI has taken down the plugin. The piece concludes by recommending reviewing installed skills as a set, checking information flow and authorization before critical operations, and verifying the ownership of every domain a skill references.