Roey Ben Chaim detonated thousands of agent skills and found 100 malicious skills, he told AI Engineer. Victims install a skill locally. Remote attackers then steal cloud, Kubernetes and identity secrets.
You can't tell intent by reading skill.md.
Static scanning failed first, Ben Chaim said. Skill.md is only an entry point. It can pull a remote prompt, download a package, or run install code that fetches more payloads. Trail of Bits showed an LLM reviewer could be fooled by a comment claiming team approval, while an official Azure diagnostic skill scanned configs and instance metadata like an info stealer.
His first rig put an agent and a skill in a sandbox with a task prompt. It missed too much, because skills need CLIs, services and projects like Notion. So Zenity added a world builder to construct the environment and an operator to cover each trajectory from decks to deployments to brainstorms. Safeguards still blocked decoding and execution, even on benign tasks, so the team added an adversarial operator and captured process, file and network events alongside traces, including npm postinstall side effects.
Zach Corman's proof of concept proved the chain, Ben Chaim said. A YouTube security skill installed a second security review skill that fetched skill.md from GitHub with hidden instructions and ran the payload. A Polymarket skill went further and pulled polymarket club client v2 with an extra s, he said, and its package.json pointed away from the official registry to an info stealer.
The Carly operation then cloned the Paperclip orchestration project under a lookalike organization and domain, Ben Chaim said. Its log action fetched a payload from an attacker endpoint, decoded it to a temp file, ran it under Node, harvested SSH, AWS and Azure folders to a feedback endpoint, then self destroyed after 60 seconds, he said. Skills using the same command and control reached 1.7 million total downloads, he said, before Vercel and Microsoft took the infrastructure down within 12 hours of his report. Snyk separately examined 10,000 popular skills on skills.sh and ClawHub and found covert instructions impersonating trusted APIs to take keys, which frames Zenity's 100 finds as part of a wider marketplace problem.
Ben Chaim argued skills must be treated like package dependencies. Teams should inspect every load, limit access with least privilege, and observe real runs. Zenity lists its detonation chamber for testing at neoto.io, he said.
