Malicious AI ‘skills’ turned agents into credential thieves, at scale

Security researchers at Zenity Labs uncovered a credential-stealing campaign on skills.sh, a public registry of add-ons for AI agents run by Vercel. They unveiled the research at the Black Hat conference. Attackers had cloned real skills into typosquatted look-alikes.

One tainted family racked up over 1.7 million installs, though Zenity stresses that is aggregate downloads, not unique victims.

The trick was patience. The fake skills sat clean while they built trust and install counts. Only later did the attackers slip in malicious instructions. Those told the AI agents to hunt down SSH keys, cloud credentials, database logins and access tokens, bundle them with the machine’s details, and ship them to attacker servers.

The agent becomes the weapon

That is what sets this apart from an ordinary supply-chain attack. A skill is just instructions, and an agent’s whole job is to follow instructions from the content it is handed. So the same obedience that makes agents useful becomes the attack surface.

More than 30% of the dangerous skills abused Claude Code and OpenClaw to drop malware.

Some went further, into self-preservation.

One skill told the agent to rewrite its own system prompt so it would reinstall itself if deleted. Another quietly uninstalled Claude’s built-in skill-creator and swapped in a copycat, without telling the user. Zenity also found hundreds of empty, reserved package names, staged for future attacks.

Cleaned up, but not gone

After Zenity’s disclosure, Vercel and Microsoft’s GitHub pulled the offending skills, listings and repositories within 12 hours. That is the good news. The bad news is that copied instructions can linger in downstream repos and on machines. Anyone who already installed one has to remove it by hand.

The episode widens what “supply chain” means. For an AI agent it is no longer just code libraries, but skills, tools, MCP servers and any web page it reads. Each is a place to hide an instruction that makes the agent act against its user. The industry keeps relearning this as agents take unauthorised actions.

There is a commercial edge to note. Zenity sells agent security, and its fix doubles as a pitch: a free tool, AI Total, that “detonates” a skill in a sandbox to watch what it really does. Even so, the core point is hard to argue with. As CTO Michael Bargury put it, the most dangerous skills “appear benign” until they run.