Blog de Cyera

An AI skill is a folder of instructions in natural language that tell an agent how to perform a task, whether filling out a PDF, piecing together a complex report, or reviewing code. These folders can include binaries, scripts, and other types of files. Agents read these instructions and act on them, often with access to your files and command line. While popular agentic tools may come with a handful of skills built in, most of them arrive as part of plugins or from public marketplaces, much like browser extensions.

Skills have become an attractive new attack vector for threat actors because agents can be tricked into following whatever instructions exist in the primary instruction file (SKILL.md) — often without the knowledge or permission of a human. That can include downloading malware and providing command-line access to a remote operator. Since skills are such a new invention, many businesses also lack the processes or tools to guard against these threats.  

Cyera Research analyzed 1 million AI skills and found clear evidence of malicious intent. We identified 516 samples linked to the AMOS malware campaign and multiple PDF skills that imitated the official Anthropic version but provided a Linux reverse shell. Our upcoming research builds on these findings with a deeper analysis of 1.3 million skills, MCP servers, and plugins.

Security grades assigned by marketplaces and quick checks of the skill files can be misleading, as malicious skills use titles and descriptions that mirror the real thing. Comparing the full package, in detail, to a version you know is legitimate can help identify problems. Hunting markers we found that could be useful include urgent language (like “Important” or “Critical Requirement”), false dependencies (“will not work unless” or “requires [X] agent”), encoded commands, and links to paste sites.