Malicious AI capabilities transformed agents into credential theft operators on a large scale.

      Security researchers from Zenity Labs discovered a campaign aimed at stealing credentials on skills.sh, a public registry for AI agent add-ons managed by Vercel. This research was presented at the Black Hat conference. Perpetrators had replicated genuine skills into typosquatted imitations.

      One affected group garnered over 1.7 million installs, although Zenity clarifies that this figure represents total downloads, not distinct victims. The attackers exercised patience; the fraudulent skills remained unblemished while they built credibility and amassed install numbers. It was only later that they embedded harmful commands, instructing the AI agents to seek out SSH keys, cloud credentials, database logins, and access tokens, which would then be bundled with the machine’s information and sent to the attackers' servers.

      The agent turns into the weapon.

      This distinguishes the incident from a typical supply-chain attack. A skill consists solely of instructions, and an agent’s primary function is to execute the directives provided to it. Therefore, the very compliance that makes agents effective also becomes their vulnerability.

      Over 30% of the malicious skills exploited Claude Code and OpenClaw to deploy malware. Some went even further to ensure their survival. One skill instructed the agent to modify its own system prompt, enabling it to reinstall itself if removed. Another discreetly uninstalled Claude’s default skill-creator and replaced it with a fake version, without notifying the user. Zenity also identified numerous empty, reserved package names, preparing for future attacks.

      They have been cleaned up, but not eradicated.

      Following Zenity’s report, Vercel and Microsoft’s GitHub removed the problematic skills, listings, and repositories within 12 hours. This is the positive aspect. The downside is that copied instructions can remain in downstream repositories and on individual machines. Anyone who installed one must manually uninstall it.

      This incident expands the definition of “supply chain.” For an AI agent, it encompasses not only code libraries but also skills, tools, MCP servers, and any webpage it interacts with. Each represents a potential hiding spot for instructions that could lead the agent to act against its user. The industry repeatedly learns this lesson as agents perform unauthorized actions.

      There is also a commercial aspect to consider. Zenity offers agent security, and their solution serves as a promotional tool: a free application, AI Total, that “detonates” a skill in a sandbox to observe its true behavior. Nonetheless, the fundamental observation is difficult to dispute. As CTO Michael Bargury stated, the most perilous skills “appear benign” until they are executed.