RepoJacking: 178 Skills Hijacked Through The Repositories They Depend On, 23,812 Agents Affected

We already showed what happens when the account behind a skill is deleted: the username goes back in the pool, and whoever claims it owns everything installed from it.

So we went looking for the opposite case. An author who is present. A repo that is alive. An account that was never abandoned at all.

The Eng0AI case

Another landing page skill today, awwwards-landing-page. Point your agent at it and you get a Next.js portfolio site, scaffolded and deployed. Over 1000 installs say people like it.

The author wants the templates to always be up-to-date so he pulls them from another one of his repos.

When people installed the skill, everything checked out. A real account with a real history, publishing a small bundle of starter skills, the templates repo alive and actively maintained. Code that does exactly what it claims. Nothing anonymous, nothing brand-new, nothing dangling.

Except that repo has been hijacked.

Other than templates the repository contains malicious code the agent installs. Not one public scanner found out.

How Did This Happen?

When pulling the templates the skill runs:

git clone --depth 1 https://github.com/Eng0AI/awwwards-landing-page-template.git .
npm install

At some point the user was renamed to rebyteai-template. Nothing broke - GitHub frees the old username and starts redirecting to the new user's repo, so every existing link keeps resolving.

But the freed username is anyone's to claim:

1. Eng0AI renamed itself rebyteai-template. Eng0AI is now free to claim.
2. The skill still uses github.com/Eng0AI/awwwards-landing-page-template which GitHub now redirects to the repo under the new username.
3. We registered a new account named Eng0AI.
4. We created a repo under it with the same name - which ^{shadows the redirect}.
5. Every agent that runs the skill now ^{clones from us}.

The skill's own source repo is untouched, still exactly where it always was, still clean. We never needed the skill's repo.

In the SkillJacking case, the author let their account die. This one did everything right, and we still ended up holding the part that matters.

This isn't a special case

Abandoned GitHub repos and accounts are not rare. We counted 124 of them referenced by skills, affecting 178 skills and 23,812 agents. Every one is a username someone else can claim, and not one of the skills involved ^{ever changed}.

Installing before we took the name is no protection - the skill clones that repo ^{every time it runs}, so a copy installed months ago pulls our code the next time anyone uses it. You don't need to install anything new. You just need to use what you already have.

Nobody had to go rogue for it, either. No malicious commit, no breached account, no maintainer breaking bad - someone renamed an account correctly and moved on, and a username went back in the pool. There is no event here for a one-time check to have caught.

What should security teams do?

Eng0AI was clean when people installed it. That is the whole problem - it was vetted once, and then nobody looked again, not at the skill and not at the repository it clones every time it runs. Luckily, we can do better:

1. Vet the skill's dependencies, not just the skill itself. This skill passes every check you can name; but the dependencies are not scanned. No public scanner has noticed the hijack happened. We must scan every repository, package, domain and host it reaches for, and how easily any of them could change.
2. Vet continuously, not only once when installed. Nothing announces a username changing hands, so a skill you cleared last month may be ^{cloning from a stranger} today.
3. Only install add-ons from a secure marketplace. Everything must get scanned before listing, rescan continuously, revocable everywhere at once.

So we ran awwwards-landing-page through ScanAir, which continuously scans for RepoJacking and other takeover attacks: the renamed owner, the freed handle, the repo it clones at runtime - ^{flagged on sight}.