Malicious AI Skills Hijack Credentials on Vercel Registry, Researchers Reveal

Key Points

• Zenity Labs uncovered a credential‑stealing campaign on Vercel’s AI‑agent skill registry, skills.sh.
• Attackers cloned popular skills, creating typosquatted copies that amassed over 1.7 million installs.
• Malicious skills harvested SSH keys, cloud tokens, database passwords and sent them to attacker servers.
• Some skills added self‑preservation code, reinstalling themselves or swapping out legitimate components.
• Vercel and GitHub removed the rogue listings within 12 hours after disclosure.
• Copies of malicious instructions may linger in downstream repos; users must manually clean affected systems.
• The breach expands the definition of software supply‑chain risk to include AI skills and related assets.
• Zenity offers a free sandbox tool, AI Total, to test skills before deployment.