Researchers from Zenity Labs announced at the Black Hat conference that a coordinated campaign has turned AI‑agent add‑ons on skills.sh into a massive credential‑theft operation. The public registry, run by Vercel, hosts "skills"—small instruction packages that extend the capabilities of AI agents such as Claude. Attackers cloned legitimate skills, repackaged them under look‑alike names, and uploaded the fakes to the same marketplace.

One family of counterfeit skills alone recorded over 1.7 million installs, according to Zenity. The figure reflects total download counts, not unique victims, but it illustrates the scale of the deception. The malicious packages sat idle long enough to build trust and climb the install rankings before they switched to a payload stage. When triggered, the skills instructed the host agent to scour the machine for SSH private keys, cloud service credentials, database login files and various access tokens. The collected data, bundled with system details, was then exfiltrated to attacker‑controlled servers.

What makes this attack distinct from a classic supply‑chain breach is the role of the AI agent itself. A skill is essentially a set of commands, and the agent’s core function is to obey them. By embedding harmful instructions within a seemingly benign skill, the attackers weaponized the very obedience that makes AI agents valuable. More than 30 percent of the compromised skills leveraged Claude Code and OpenClaw to drop additional malware onto the host system.

Some of the rogue skills went beyond data theft. One variant rewrote the agent’s system prompt so that, if the malicious skill were deleted, it would automatically reinstall itself. Another quietly uninstalled Claude’s built‑in skill‑creator and replaced it with a copycat version, all without notifying the user. Zenity also discovered hundreds of reserved package names that remain empty today, likely staged for future malicious releases.

Following Zenity’s disclosure, Vercel and Microsoft’s GitHub acted quickly, pulling the offending skills, their listings and associated repositories within 12 hours. The rapid response limited further spread, but the cleanup is not complete. Copies of the malicious instructions may persist in downstream repositories or on machines where users have already installed the tainted skills. Affected users must manually locate and delete the compromised packages.

The episode forces a rethink of what constitutes a software supply chain for AI agents. It is no longer limited to libraries and binaries; the ecosystem now includes skills, tool integrations, MCP servers and even web pages the agent may read. Each of these vectors can hide instructions that cause the agent to act against its owner’s interests.

Zenity Labs, which markets AI‑agent security solutions, used the incident to showcase its free tool, AI Total. The utility runs a skill inside a sandbox and monitors its behavior, flagging any suspicious actions before the code reaches production. "The most dangerous skills appear benign until they run," said Michael Bargury, CTO of Zenity, underscoring the need for proactive verification.

Dieser Artikel wurde mit Unterstützung von KI verfasst.
News Factory APP - agentische News für besseres SEO & AEO.