Two separate findings landed within weeks of each other, and it’s worth being precise about which is which, because a lot of the coverage wasn’t.
The first is a risk scan, not a malware report. A security startup called AIR, disclosing itself alongside the finding, scanned public AI skills — the SKILL.md-based reusable-workflow format Anthropic introduced in October 2025 and open-sourced two months later — and found 17,800 of them across 6.7 million installs pulling runtime instructions from unverified external sources, some impersonating Anthropic and OpenAI by name. That’s a provenance check: it flags skills that could have their behavior changed after installation by whoever controls that external source, not skills confirmed to be actively malicious. AIR itself hasn’t claimed otherwise. The distinction matters because “pulls instructions from an unverified source” and “is malware” are different claims, and treating a provenance flag as a confirmed compromise overstates exactly the kind of thing this site tries not to do.
The second finding is the confirmed attack, and it’s a genuinely clean case study in how supply-chain compromise works in practice. Zenity Labs, disclosing at Black Hat USA in early August, described a campaign on Vercel’s skills.sh registry with a simple shape: clone a skill people already trust, let the clone quietly accumulate real downloads and a legitimate-looking install count, then poison it later, after it’s earned enough trust that people stop checking it. By the time it was caught, the poisoned skill had cleared 1.7 million installs. This is the textbook software supply-chain pattern — a compromised dependency, a typosquatted package — just arrived in the skill-marketplace format roughly eighteen months after the format itself existed.
Both findings point at the same structural gap regardless of severity: a skill is just a folder of instructions and scripts an agent loads and trusts because it matched the task, and most of today’s marketplaces check what a skill claims to do at install time, not what it actually does at runtime, and not who’s genuinely behind it after that first install. A one-time read of a SKILL.md file doesn’t catch a clone that behaves identically for months before its maintainer — or whoever took over the account — changes what it does.
The response already forming looks familiar if you’ve read anything else I’ve covered under security this month: CrowdStrike shipped a tool to discover and gate unapproved agents on a network, and AIR’s own product is a runtime firewall that screens instructions and tool calls before an agent acts on them, rather than trusting what a skill’s documentation said when it was installed. Which is really the same lesson as everything else in the sandbox-escape thread: a check that only runs once, at the point something looked trustworthy, isn’t a check that holds up once that thing has months to quietly become something else.
