Skills.Sh

skills.sh is a shell script tool that automates the assessment and documentation of technical competencies within development teams. In the context of AI governance, it helps organizations identify capability gaps in AI literacy and compliance knowledge across their workforce. This becomes critical for enterprises implementing responsible AI practices, as maintaining current skills inventory directly impacts the quality of governance decisions and regulatory readiness.

1 item

ResearchGlobal2026-08-07

1.7M Trojanized AI Skill Installs Expose Agent Marketplace as Active Attack Surface

Security firm Zenity disclosed a supply chain campaign in which malicious skills uploaded to the skills.sh agent marketplace accumulated over 1.7 million downloads between July 11 and August 2, 2026. The trojanized skills, which impersonated legitimate AI services Paperclip and Browser Use through typosquatting, instructed AI agents to install a credential stealer targeting SSH keys, cloud credentials, Kubernetes configurations, and CI runner secrets. The incident confirms that agent skill marketplaces are now an active attack surface and that conventional static analysis tools are poorly suited to detecting malicious natural-language skill instructions.

supply chain attack agentic AI risk credential theft agent marketplace AI agent security Zenity skills.sh plugin governance