Poisoned Skills: Malicious Instructions for Agents
We analyzed more than 1 million AI skills.
We found hundreds designed to steal credentials and open remote shells.
Off the path
See if you can spot the traps on your agent’s path to Grandma’s.
The research
Two campaigns and the techniques powering them
Two confirmed campaigns and a deeper analysis of real threats in the wider skills ecosystem. For each one, a brief for security leaders on how these risks fit into the broader threat landscape plus the full analysis, IoC tables and all, for practitioners.
The AI Agent Supply Chain: By the Numbers
Our upcoming report analyzes trends across a broader set of AI skills. Discover the top techniques attackers use to slip past security checks and what defenders can do about it.
The AI Agent Supply Chain: By the Numbers
Our upcoming report analyzes trends across a broader set of AI skills. Discover the top techniques attackers use to slip past security checks and what defenders can do about it.
Build a plan of action
A step-by-step guide on how to vet, hunt for, and respond to malicious AI agent skills.
The researcher’s take
Veteran security researcher Fufu Shpigelman digs into the findings and methodology. Find out what the Cyera Research team scanned, how these campaigns work, and what red flags to look out for.
70 confirmed malicious skills.
Every one carried a high security grade.
What’s at risk
How they fooled the graders
How Cyera helps
Behind the research
%20Shpigelman.avif)
About Cyera Research
Cyera Research studies how AI systems and agents access, use, and expose sensitive data. The team combines vulnerability research, threat hunting, and insights from Cyera’s own platform data to uncover maximum-severity flaws in applications and in the infrastructure everything runs on, like Docker and PostgreSQL.
FAQs
An AI skill is a folder of instructions in natural language that tell an agent how to perform a task, whether filling out a PDF, piecing together a complex report, or reviewing code. These folders can include binaries, scripts, and other types of files. Agents read these instructions and act on them, often with access to your files and command line. While popular agentic tools may come with a handful of skills built in, most of them arrive as part of plugins or from public marketplaces, much like browser extensions.
Skills have become an attractive new attack vector for threat actors because agents can be tricked into following whatever instructions exist in the primary instruction file (SKILL.md) — often without the knowledge or permission of a human. That can include downloading malware and providing command-line access to a remote operator. Since skills are such a new invention, many businesses also lack the processes or tools to guard against these threats.
Cyera Research analyzed 1 million AI skills and found clear evidence of malicious intent. We identified 516 samples linked to the AMOS malware campaign and multiple PDF skills that imitated the official Anthropic version but provided a Linux reverse shell. Our upcoming research builds on these findings with a deeper analysis of 1.3 million skills, MCP servers, and plugins.
Security grades assigned by marketplaces and quick checks of the skill files can be misleading, as malicious skills use titles and descriptions that mirror the real thing. Comparing the full package, in detail, to a version you know is legitimate can help identify problems. Hunting markers we found that could be useful include urgent language (like “Important” or “Critical Requirement”), false dependencies (“will not work unless” or “requires [X] agent”), encoded commands, and links to paste sites.
.svg)
