A new audit adds hard numbers to a problem that's been mostly anecdotal: AI agent skill marketplaces are full of extensions nobody has checked. Lakera's review of the OpenClaw ecosystem found that its audit of 4,310 OpenClaw skills uncovered confirmed malware delivery, OAuth over-provisioning, and supply chain risks in agent marketplaces. One flagged skill routed traffic through unverified HTTP endpoints, effectively proxying potentially sensitive data through infrastructure outside the user's control, while another transmitted ArXiv credentials to a raw IP address rather than a documented domain. Lakera's deeper pass on 221 skills found that insecure engineering patterns were widespread, even where no explicit malicious intent was present. The mechanism is the same one that's already burned code-review agents. A separate test by Manifold Security showed a Claude-powered GitHub Actions workflow auto-approve and merge a malicious pull request because it recognized a spoofed commit author as a recognized industry figure — the agent trusted an identity string with no signature behind it. A search turned up over 12,400 public workflow files referencing claude-code-action, many of them making trust decisions based on unsigned commit author identity. The exploit chain in that case ended with a malicious SKILL.md landing in a default branch, waiting for the next developer to ask their coding agent to 'set up the IDE' — a routine request that triggered execution of an attacker's bootstrap script. What both findings share is a missing layer: nothing in the skill-install or PR-review pipeline actually verifies who wrote an instruction before an agent executes it. The name on a commit, the description text on a skill page, the label on an OAuth scope request — none of it is signed or checked against a source of truth. Anthropic's own disclaimer on public artifacts concedes as much: content is user-generated and unverified, full stop. This is a provenance gap, not a filtering gap. Better malware scanners catch known-bad payloads after the fact; they don't address the deeper issue that an agent has no way to demand proof of who authored an instruction before acting on it. Marketplaces and agent frameworks that want to close this need attestation at the point of install — a signed claim about who published a skill or wrote a commit, checkable by the agent itself, not a human relying on a display name. Until that exists, every skill install and every auto-merge is a bet that the label matches the sender.