1.7M Trojanized AI Skill Installs Expose Agent Marketplace as Active Attack Surface
What happened
Security firm Zenity disclosed a targeted supply chain attack in which threat actors uploaded trojanized skill files to the skills.sh agent marketplace, typosquatting on two legitimate AI services: Paperclip and Browser Use. Between July 11 and August 2, 2026, the malicious skills accumulated over 1.7 million downloads before discovery, as reported by CSO Online. Once deployed, the skills instructed AI agents to install a credential stealer designed to harvest SSH keys, cloud provider credentials, Kubernetes configuration files, and CI runner secrets from developer and agent workspaces. A central finding with direct governance implications is that skill files contain natural language instructions rather than compiled or interpretable code, which prevents standard static analysis tools from flagging malicious content at ingestion. That detection gap means organizations relying on existing software supply chain controls to cover their agent skill ecosystems may have significant unmonitored exposure.
Why it matters
- ·Existing software supply chain security programs do not extend to agent skill marketplaces without modification: because skill files are written in natural language rather than code, they evade static analysis and code-review tools that enterprises rely on for dependency vetting, leaving intake controls blind to malicious instructions embedded in seemingly benign skills.
- ·The credentials targeted in this campaign, including SSH keys, cloud provider tokens, Kubernetes configs, and CI runner secrets, are high-value pivot points that allow an attacker to move laterally from a compromised agent workspace into production infrastructure, meaning a single poisoned skill can escalate into a broad enterprise breach.
- ·With 1.7 million installs accumulated in under four weeks, the velocity of propagation through lightly governed skill marketplaces far outpaces traditional vendor risk review cycles, exposing a timing gap in third-party AI tool intake processes that compliance teams have not yet resolved.
Governance controls affected
What to do now
- ☐Audit all agent skill and plugin sources currently in use across enterprise agent deployments, mapping each to its originating marketplace and verifying the publisher identity against official vendor registries to catch typosquatted or impersonating packages.
- ☐Restrict agent skill installation to an approved list maintained through a formal intake workflow, requiring manual review of natural-language instruction content before any skill is permitted in production environments.
- ☐Rotate all credentials stored in or accessible from developer and agent workspaces that could have been reached by a deployed skill between July 11 and August 2, 2026, prioritizing SSH keys, cloud provider tokens, Kubernetes configs, and CI runner secrets.
- ☐Update your agent supply chain risk assessment (AGT-019) to explicitly address natural-language skill files as a distinct artifact class requiring review methods beyond static code analysis, such as semantic review or sandboxed execution testing.
- ☐Implement or verify isolation controls ensuring that agent credential stores are segmented from developer workspaces, so a compromised skill cannot traverse from the agent runtime into broader infrastructure secrets.
What to watch next
Enterprises should monitor whether skills.sh and comparable agent marketplaces introduce publisher verification, code signing, or content integrity mechanisms in response to this incident, since the absence of such controls is structural rather than incidental. The OWASP Top 10 for Large Language Model Applications covers supply chain and plugin integrity risks and is likely to see updated guidance as agent-specific attack patterns become better documented. Regulatory bodies that have begun scrutinizing agentic AI deployments, particularly under the EU Cyber Resilience Act, may treat unvetted skill marketplace usage as a software supply chain risk requiring disclosure or remediation. Teams should also track whether this incident accelerates enforcement attention on agent plugin governance across sectors already under AI oversight obligations.
Stay ahead of stories like this
Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.
Recent issues
- AI agents this week destroyed backups at machine speed, leaked sensitive data without developer approval, and drew federal scrutiny that may extend liability to every enterprise deploying them.1 Oct
- A vulnerability that bypasses approved-plugin controls, new criminal liability for executives, and a landmark safety-disclosure framework all point to one conclusion: AI systems are outpacing the controls organizations have built around them.23 Sept
Free every Thursday. Unsubscribe anytime.