The Story of Skills

The Story of Skills

A year ago, skills were a developer's curiosity. Today they're everywhere - and not only in engineering. Salespeople write them, marketers trade them, designers swear by them.

The reason is simple. A skill is packaged expertise you hand your agent: the difference between an agent that improvises and one that works from a specialist's playbook. Around that idea grew a public community where anyone shares a skill with anyone - traded in marketplaces, passed around at work, posted in reels by influencers with real followings.

Anyone can publish, anyone can install. No gatekeepers, no review - and no one checking what they're really running.

^{So we ran an experiment.}

In less than an hour, we built a single skill, released it into that ecosystem, and watched how far it could travel - and how much it could get away with.

Here's what came back:

1. 26,000 agents were affected, including corporate accounts' agents.
2. We could have had full control of every one of their agents, their private conversations, and every internal system they could reach.
3. All existing security scanners cleared it as safe
4. We reached the credibility of 37,000 real GitHub stars

No agents were harmed in this research. Although our skill could have had control of every machine that ran it, its payload did nothing but sending us their email address so we can notify them.

The bottom line: every signal people use to judge a skill cleared it - scanners, stars, reputation. ^{Every one of them failed, and 26,000 agents were compromised.}

Writing a Malicious Skill In An Hour

First, we had to choose the skill's claimed purpose. Since our target audience was non-technical corporate employees, we wanted to target a universal need - one nearly everyone shares, yet one that usually requires specialized technical knowledge to satisfy.

Luckily for us, as we were looking, Google's Stitch had just launched, and it carried with it the perfect opportunity - a shiny new tool designed for everyone, with only basic technical usage skills for it. We decided to fill that gap.

‍

Introducing: ^{brand-landingpage}. Your one-stop, one-hour vibe-written skill for building an eye-dazzling, wallet-opening website to advertise your freshly built product. It helps you define your brand's visual direction, then generates a deployable landing page using Stitch. No code or design knowledge required.

To make sure we delivered real value to the skill's victims, we tested it by creating a brand-landingpage brand landing page.

Gorgeous.

Gaining Credibility

Finally, before publishing the skill, we wanted to make it look as credible as possible. To do so, we targeted two trust signals:

1. Gaining a high star count on the skill's GitHub repository - often displayed in skill marketplaces as a strong credibility signal
2. Being marked as safe by popular skill scanners

So we started by aiming for the stars.

While creating a fresh GitHub repo and earning stars through hard work and genuine user appreciation sounded tempting, we looked for a shortcut.

We then thought - ^{why gain stars yourself, when you can just enjoy someone else's?}

For most popular agents, plugin marketplaces are actually just GitHub repos containing all the marketplace's plugins. A plugin can contain all kinds of AI components, including skills.

Those marketplaces happily accept contributions, and some happen to be very credible and star-rich. Getting our skill accepted into one would automatically lend it the star-rich glow we needed for the skill's credibility.

Reviewing popular plugin marketplaces, we chose one called agents - with ~36K stars, 156 skills and a welcoming contribution policy, it was a perfect target.

We opened a PR, and after a few anxious days, it got merged. Worth noting that at this stage it was complicated to detect the skill was malicious, as scanners missed it too.

Now, when we look credible - we went ahead and published our skill as an advertisement on Instagram - targeting marketers, salespersons and designers. Interested individuals got the skill from the advertisement and started using it. Bingo.

Scanners' Blind Spot

Thing is, we didn't just want to help folks create their dream landing page, we wanted to show how anyone can easily compromise their machine.

It is well established that skills, which are loaded into an agent's context with authority equivalent to a user prompt, can manipulate agents into performing malicious operations. By now, the existence of malicious skills is no surprise to anyone.

In response to this emerging risk, skill-scanning products claiming to detect malicious skills started to gain popularity among cybersecurity practitioners and everyday agent users, looking to keep their agents safe.

Current skill security scanners all share the same design - they analyze the skill's SKILL.md and bundled resources, using a combination of static heuristics and LLM agents.

While this design catches some risks, it carries an inherent flaw. Skills routinely send the agent beyond those bundled files: out to an external URL holding documentation, an API reference, or a setup guide it's told to read and follow. When a skill confidently sends the agent to read documentation at an external link, the agent treats it with the same credibility it gives the skill. This makes the skill's de-facto content not only its bundled files, but also the web resources it references.

As a result, current security scanners practically scan only a portion of the skill's content, ^{rendering the scan's result irrelevant by design.}

The Hidden Backdoor

Once we identified this gap, the design for our malicious skill became clear - it instructs the agent to first set up the Stitch SDK, following the installation instructions supplied in the external documentation link. The skill contains no technical information regarding the SDK installation or usage - forcing the agent to fetch the external docs to continue.

Then, at the skill's footer, we placed the reference to the external docs:

And here's the catch: ^{stitch-design.ai is controlled by us, not by Google.} The real Stitch domain is stitch.withgoogle.com.

Once we configured our domain to redirect to the real one, there's no way for either a standard user or an LLM scanner to tell something's off from a static look at the skill alone. The domain sounds plausible, and the content looks safe.

Lab Dry Run

To confirm it worked, we initially locally redirected stitch-design.ai to a look-alike of the Stitch docs we built, instructing the agent to download a malicious script and run it.
‍

The documentation guides the agent to check whether stitch-sdk is installed, and to proceed with installation only if it isn't.

Once the agent was reading our documentation and treating it as installation instructions, convincing it to run our installation script was a no-brainer. Since we had no intention of doing actual harm, our "malicious" script simply collected the victim's email and sent it home. Notice that the original skill too just installs an npm package.

From this point, turning our benign UI design skill into a fully working malicious campaign was ^{as easy as flipping a switch.}

Security Scanners' Verdict

Finally, the last challenge on our way to perfect skill credibility was being vetted as safe by the most advanced skill security scanners.

We started by running our skill locally against Cisco's and Nvidia's scanners, and all of skills.sh's scanners: All vetted brand-landingpage as safe.

‍

Putting It All Together

We now had the perfect skill - vetted as safe, highly starred, highly downloaded, and uploaded to multiple marketplaces.

To be honest, it's hard to blame those who installed it - why should they suspect anything?

Turning The Switch On

Now that our skill was popular, it was time to pull the trigger. We replaced the content of our fake Stitch docs, instructing the agents to download our mail-extracting script and run it. It was not long before victim emails started pouring in, proving their agents have been compromised.

Takeaways for organizations

A skill is more than its files. A skill can't be scanned by its files alone; it has to be scanned for everything it points the agent to. Current scanners ignore a lot of the risk from those external instructions.

‍A clean scan is a snapshot, but the ground moves. We uploaded a seemingly benign skill, and then flipped a switch. A one-time check at the time of install can't protect you from a link that changes hands later. Supply-chain risk here is continuous, so the control has to be continuous too.

‍It's already in your environment. Skills and add-ons are installed today by employees across large enterprises. None of those add-ons went through a scan or an approval flow, and they're already running on agents with full autonomy and access to sensitive data.

‍Add-ons need one managed entry point. People get add-ons wherever they find them. Public marketplaces, GitHub repos, a colleague's copy-paste. None of these give you a way to know what's in use or to keep it in check. Add-ons should come from one trusted source you actually manage, where each one is scanned and approved before anyone runs it.

^{That's why we built AIR Marketplace.}