Malicious AI 'capabilities' transformed agents into credential theft operatives, on a large scale.

      Security researchers from Zenity Labs have identified a credential-stealing operation on skills.sh, a public repository for AI agent add-ons operated by Vercel. They presented their findings at the Black Hat conference, revealing that attackers replicated legitimate skills with typosquatted versions. One compromised variation amassed over 1.7 million downloads, although Zenity clarifies that this figure represents total downloads rather than unique individuals affected.

      The method relied on patience, as the fraudulent skills remained unimposing while establishing trust and accumulating download counts. Subsequently, the attackers inserted harmful instructions, directing the AI agents to seek out SSH keys, cloud credentials, database login information, and access tokens, package them with device details, and transmit them to the attackers' servers.

      This situation differentiates itself from a conventional supply-chain attack. A skill consists solely of instructions, and an agent's primary function is to execute the commands it receives. Therefore, the very aspect that makes agents effective also creates a vulnerability.

      Over 30% of the malicious skills exploited Claude Code and OpenClaw to deploy malware. Some went even further in self-preservation tactics. One skill instructed the agent to alter its own system prompt to reinstall itself if removed. Another discreetly uninstalled Claude’s native skill-creator and replaced it with a lookalike, without notifying the user. Additionally, Zenity discovered numerous empty, reserved package names, poised for future assaults.

      Although Vercel and Microsoft’s GitHub acted swiftly, removing the problematic skills, listings, and repositories within 12 hours of Zenity’s announcement, there remains a concern; copied instructions can persist in downstream repositories and on user machines. Anyone who has previously installed one must manually eliminate it.

      This incident expands the definition of “supply chain.” For an AI agent, it now encompasses not only code libraries but also skills, tools, MCP servers, and any web page accessed. Each of these serves as a potential hiding spot for instructions that could manipulate the agent against its user. The industry is continuously reminded of this issue as agents perform unauthorized actions.

      Furthermore, there is a commercial aspect to consider. Zenity offers agent security solutions, and its resolution acts as a promotional tool: a free application, AI Total, that "detonates" a skill in a sandbox environment to monitor its true behavior. Nonetheless, the fundamental observation remains difficult to dispute. As CTO Michael Bargury noted, the most perilous skills “seem harmless” until executed.