# Agent skills: 121 components reach domains rated high risk

> Manifold found 121 agent skills, MCP servers and plugins that call domains its scan rated high risk.

- **Severity:** Medium: Real and reproducible, but needs unusual setup, user help or a narrow audience. Plan a fix.
- **Category:** Supply chain, Research
- **Published by:** Manifold Security
- **Disclosed:** 2026-10-13
- **Affects:** AI agent skills, MCP servers, Agent plugins
- **Research by:** Swapnil Patil (Manifold), Cody Nash (Manifold)
- **Primary source:** https://www.manifold.security/blog/high-risk-domains-agent-skills-where-they-lead
- **Page:** https://theinjection.dev/items/manifold-agent-skill-high-risk-domains/

Manifold rated 100 domains used by indexed agent components high risk, and found 121 components that call them: 108 skills, 11 MCP servers and 2 plugins, including a crypto miner skill using domains listed as botnet C2.

## What happened

Researchers Swapnil Patil and Cody Nash published a scan of the domains behind agent components on October 13, 2026. Starting from 5,458,152 URLs in Manifold's Manifest index of skills, MCP servers and plugins, they reduced the set to 63,446 distinct domains and download hosts, then rated 100 of those high risk.

## How it works

Free checks ran against every domain first: the ThreatFox and HaGeZi threat feeds, popularity rankings, and the malware filters of Quad9 and Cloudflare. About 1,900 flagged domains then went to paid lookups at VirusTotal, AlienVault OTX, urlscan.io and Shodan. The authors then read how each component actually used each domain, because many appear only in documentation or test fixtures.

## Who is affected

Anyone running one of the 121 named components is exposed, and the mix is listed below. Finance skills are over-represented: they are 43% of the skills calling a high-risk domain while making up 6% of all indexed skills. Sixteen skills tell agents to run code from a high-risk domain, eleven of them through a polyfill.io script tag.

## What to do

Treat the domains inside skills, MCP configs and plugins as dependencies, and check them against protective DNS and reputation sources before an agent loads one. Watch where agents connect, not only what commands they run, and re-check approved components on a schedule, because a clean domain can change hands.

## Quick facts

- **Scanned:** 5,458,152 URLs, reduced to 63,446 domains and download hosts
- **High-risk domains:** 100
- **Components affected:** 108 skills, 11 MCP servers, 2 plugins
- **Code execution:** 16 skills run code from a high-risk domain, 11 via a polyfill.io script tag
- **Worked example:** clawrtc, a crypto miner skill that reports host name and MAC addresses
- **Found by:** Swapnil Patil and Cody Nash, Manifold

## Questions

### Which agent components did Manifold find calling high-risk domains?

Manifold names 121 components from its Manifest index: 108 skills, 11 MCP servers and 2 plugins. Finance skills are over-represented, at 43% of the skills that call a high-risk domain while making up 6% of all indexed skills. The authors describe these counts as a floor, because some malicious domains passed every check they ran.

### What is clawrtc and are its domains still in use?

Clawrtc is a crypto miner skill whose installer contacts an undisclosed domain, bottube.ai, and whose miner reports the host name and MAC addresses. ThreatFox listed that domain and rustchain.org as botnet command and control in April. Manifold reports that as of October 2026, 17 skills and one MCP server still used those two domains.

### How can a team vet agent skills for risky domains before installing them?

Pull the domains out of a skill, MCP config or plugin and check them against protective DNS and reputation services, as Manifold did with ThreatFox, Quad9 and Cloudflare filters. Read installers before an agent runs them, monitor which destinations agents connect to, and re-check approved components periodically, since a once-clean domain can change owners.

## Sources

1. [Manifold Research](https://www.manifold.security/blog/high-risk-domains-agent-skills-where-they-lead)
2. [Manifest Registry](https://manifest.manifold.security/)