Loading story…
AI-agent skill packages and repository instruction files are emerging as a supply-chain attack vector: attackers can alter natural-language instructions in files such as SKILL.md or AGENTS.md to hijack an agent’s goals and use its existing tools, credentials, filesystem access, and network connectivity. Reported examples include the ClawHavoc campaign, Atomic macOS Stealer distribution through OpenClaw skills, and a malicious ClawHub skill identified by Cisco that exfiltrated data and injected prompts; compromised release pipelines and malicious package releases can also seed this control plane.
The impact depends on the authority granted to the affected agent, particularly where it can execute commands or access secrets without meaningful approval. Organizations should treat agent instructions and skills as privileged, untrusted dependencies: maintain an inventory, review raw source and Unicode content, use vetted internal registries and pinned versions, sandbox agents, constrain credentials and outbound access, and ensure approval prompts disclose the actual command payload and destination. Instruction-file tampering should trigger investigation and restart of potentially compromised agent sessions.
Track how attackers are adapting to this technology.
13 events from the most recent confirmed update back to the earliest known activity.
Jiarui Li and seven co-authors submitted a paper introducing Skill Policy Integrity and SkillShift, a black-box framework for covertly steering LLM-agent decisions through plausible skill-policy edits. In agentic commerce and software-dependency scenarios, SkillShift achieved attacker-favored selection rates of 81.33% and 63.33% while preserving utility and evading evaluated scanners.
Malicious LiteLLM versions appeared on PyPI within days of the Trivy release-pipeline compromise. The incident was contained, with reported impact limited to some leaked API keys.
A compromise of Trivy's release pipeline exposed publishing credentials, creating a software supply-chain risk that could also affect agentic environments reliant on compromised packages.
The public OpenClaw marketplace ClawHub reportedly exceeded 10,000 community-contributed agent skills, expanding the third-party skill supply chain.
Embrace the Red demonstrated that a legitimate agent skill could be invisibly backdoored using Unicode tag characters, causing an agent to execute an arbitrary command when the skill was invoked.
Between January 27 and January 31, the ClawHavoc campaign uploaded 341 malicious skills to the ClawHub marketplace. Koi Security assessed 335 of them as part of one coordinated operation targeting SSH keys, API credentials, cryptocurrency-wallet keys, browser passwords, and .env files; at the campaign's peak, five of ClawHub's seven most-downloaded skills were confirmed malware.
OWASP published a dedicated Agentic Skills Top 10 as the ecosystem faced active attacks and supply-chain risks from malicious skill instructions and bundled code.
Anthropic published the Agent Skills specification as an open standard. Microsoft subsequently adopted Agent Skills within VS Code and GitHub, according to Anthropic product manager Mahesh Murag.
OWASP published its broader Top 10 for Agentic Applications, preceding its later dedicated guidance for agent skills.
Anthropic launched Skills for Claude, introducing reusable skill packages centered on natural-language instructions for agents.
Cisco's AI Threat and Security Research team analyzed the third-party ClawHub skill “What Would Elon Do?” and found nine security issues, including two critical and five high-severity findings. The number-one-ranked skill included a silent curl command to exfiltrate data and a prompt injection intended to bypass assistant safety guidelines.
Trend Micro documented a campaign distributing Atomic macOS Stealer through disguised OpenClaw skills. The skills used professional-looking documentation and a fake password-required setup process to induce malware installation through the agent's trusted role.
Snyk scanned 3,984 skills from ClawHub and skills.sh in its ToxicSkills audit, finding critical-severity issues in 13.4% and at least one flaw of any severity in 1,467 skills (36.8%). It reported that eight of 76 confirmed malicious payloads were still publicly available on ClawHub at the time of reporting.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
3 references tracked. Mallory keeps watching after this page renders.
arxiv.org
Open sourceprompt.security
Open sourcenoma.security
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers are warning that *AI agent “Skills”* (markdown/YAML instruction packages that extend agent capabilities) are becoming a **supply-chain risk** due to hidden prompt-injection content that can survive human review. A demonstrated technique uses **invisible Unicode Tag codepoints** embedded in skill files to smuggle instructions that some models interpret as executable guidance, enabling outcomes such as **data exfiltration**, prompt injection, and other malicious behavior when the skill is invoked; a basic scanner was also built to help detect these hidden-instruction patterns. Separate reporting highlighted broader evidence of the same threat pattern across agent ecosystems: Simula Research Laboratory identified **hidden prompt-injection attacks** in a measurable portion of sampled content on a platform referenced as Moltbook, and Cisco researchers documented a malicious agent skill (“**What Would Elon Do?**”) that **exfiltrated data to external servers** while being artificially boosted to appear as a top-ranked skill. Researchers also anticipate the emergence of **self-replicating adversarial prompts** (“prompt worms/viruses”) that could propagate through networks of communicating AI agents, amplifying the impact of compromised skills and poisoned instruction content.
Jun 29, 2026
Researchers reported multiple campaigns abusing *AI agent “skills”* as a new supply-chain-like initial access vector. In one case, a malicious ClawHub skill (`bob-p2p`) masqueraded as a decentralized API marketplace and was promoted via the AI-agent social platform *Moltbook*; once installed, it caused agents to retain **plaintext Solana private keys** and execute transactions that bought worthless `$BOB` tokens while routing value to attacker-controlled infrastructure. Staiker researchers and analyst Dan Regalado highlighted that agent-to-agent collaboration, shared workflows, and dependency chains can enable **lateral movement without direct human interaction**, making the technique repeatable and scalable beyond crypto-wallet theft. Separately, Trend Micro described a shift in **Atomic macOS Stealer (AMOS)** distribution from cracked software to **malicious OpenClaw skills** hosted across ClawHub, SkillsMP, and GitHub. The campaign used seemingly benign `SKILL.md` instructions to trick models/users into installing a fake prerequisite (“OpenClawCLI”) from an external site; if followed, the workflow fetched and executed a **Base64-encoded command** that dropped a **Mach-O universal binary** (Intel and Apple Silicon). Trend Micro reported 39 malicious skills uploaded across repositories and stated that more than **2,200** malicious skills were ultimately found on GitHub, with AMOS targeting credentials, browser data, crypto wallets, Telegram data, VPN profiles, Apple Keychain items, and common user folders—underscoring that AI-agent ecosystems are becoming a practical malware delivery and data-theft channel.
Jun 29, 2026
OWASP has published a final Top 10 list of security risks for agentic AI skills and introduced the **Universal Agentic Skill Format v1.0**, warning that **malicious skills** and **supply-chain compromise** are the most urgent threats facing enterprise AI agents. The guidance highlights how untrusted external instructions, overprivileged skills, and weak visibility into deployed agents can let attackers abuse legitimate automation paths rather than relying on classic prompt injection alone. The release follows public demonstrations showing how a single weaponized skill or plugin can compromise agents at scale. Researchers described a campaign in which a malicious skill distributed through an Instagram ad reportedly led to the hijacking of **26,000 agents**, while another proof of concept showed an unofficial Claude Code marketplace plugin coercing an AI coding assistant to install a trojanized `httpx` package from an attacker-controlled source. OWASP and industry practitioners said such attacks can steal credentials, persist through dependency manipulation, and evade detection unless organizations inventory agent usage and can rapidly disable malicious skills across their environments.
Aug 21, 2026