--- title: Malicious AI ‘skills’ turned agents into credential... description: Security researchers at Zenity Labs discovered a credential-stealing campaign on Vercel's skills.sh, a public registry for AI agent add-ons. Attackers... canonical: https://daily.dev/posts/malicious-ai-skills-turned-agents-into-credential-thieves-at-scale-tbrzkmxef twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Malicious AI ‘skills’ turned agents into credential thieves, at scale | daily.dev og:description: Security researchers at Zenity Labs discovered a credential-stealing campaign on Vercel's skills.sh, a public registry for AI agent add-ons. Attackers... og:url: https://daily.dev/posts/malicious-ai-skills-turned-agents-into-credential-thieves-at-scale-tbrzkmxef og:image: https://api.daily.dev/og/posts/tBRZKMxEf.png og:image:alt: Malicious AI ‘skills’ turned agents into credential thieves, at scale og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Malicious AI ‘skills’ turned agents into credential thieves, at scale **[The Next Web](https://daily.dev/sources/tnw)** · 3 min read · 0 upvotes · 0 comments ## Summary Security researchers at Zenity Labs discovered a credential-stealing campaign on Vercel's skills.sh, a public registry for AI agent add-ons. Attackers published typosquatted clones of legitimate skills that initially appeared clean to build trust and install counts. One malicious skill family accumulated over 1.7 million aggregate downloads. Once activated, the fake skills instructed AI agents to harvest SSH keys, cloud credentials, database logins, and access tokens, then exfiltrate them to attacker servers. Some skills went further, rewriting their own system prompts to survive deletion or silently replacing Claude's built-in skill-creator with a malicious copycat. Over 30% of dangerous skills abused Claude Code and OpenClaw to drop malware. Vercel and GitHub removed the offending skills within 12 hours of disclosure, but manually installed copies may persist. The incident broadens the definition of AI supply-chain risk beyond code libraries to include skills, MCP servers, and any web content an agent reads. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How did the malicious AI skills on Vercel's skills.sh steal credentials from AI agents? The malicious skills started clean to build trust and install counts, then had malicious instructions injected later. Those instructions told AI agents to locate SSH keys, cloud credentials, database logins, and access tokens, bundle them with machine details, and send them to attacker-controlled servers. Some skills also rewrote the agent's system prompt to reinstall themselves if deleted, or silently replaced Claude's built-in skill-creator with a malicious copy. _Teams deploying AI agents track emerging attack patterns like this on daily.dev before they reach production._ ### What does the AI agent skills supply chain attack mean for the definition of supply chain risk? The attack expands supply chain risk for AI agents beyond code libraries to include skills, tools, MCP servers, and any web page an agent reads. Because a skill is just instructions and an agent's job is to follow instructions, the same obedience that makes agents useful becomes the attack surface — any content the agent consumes can carry instructions that make it act against its user. _Developers building on AI agent frameworks keep up with this evolving threat surface on daily.dev._ ## Similar posts on daily.dev - [More Malicious OpenClaw Skills Threaten AI Supply Chain](https://daily.dev/posts/more-malicious-openclaw-skills-threaten-ai-supply-chain-ir1m374gw) · Dark Reading · 0 upvotes · 0 comments - [A fake AI agent skill passed every security scanner and reportedly reached 26,000 agents](https://daily.dev/posts/a-fake-ai-agent-skill-passed-every-security-scanner-and-reportedly-reached-26-000-agents-bdcaqioyv) · The Next Web · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#ai-agents](https://daily.dev/tags/ai-agents), [#mcp](https://daily.dev/tags/mcp), [#claude-code](https://daily.dev/tags/claude-code) [View this post on daily.dev](https://daily.dev/posts/malicious-ai-skills-turned-agents-into-credential-thieves-at-scale-tbrzkmxef) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious AI ‘skills’ turned agents into credential thieves, at scale","url":"https://daily.dev/posts/malicious-ai-skills-turned-agents-into-credential-thieves-at-scale-tbrzkmxef","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/malicious-ai-skills-turned-agents-into-credential-thieves-at-scale-tbrzkmxef"},"datePublished":"2026-08-08T08:17:44.953Z","dateModified":"2026-08-08T08:18:57.129Z","description":"Security researchers at Zenity Labs discovered a credential-stealing campaign on Vercel's skills.sh, a public registry for AI agent add-ons. Attackers...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ecce3f5275f3c2bae179b85732d9ef3b?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ecce3f5275f3c2bae179b85732d9ef3b?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The Next Web","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Next Web","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/tnw","url":"https://daily.dev/sources/tnw"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/malicious-ai-skills-turned-agents-into-credential-thieves-at-scale-tbrzkmxef","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cyber,ai-agents,mcp,claude-code","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Next Web","item":"https://daily.dev/sources/tnw"},{"@type":"ListItem","position":3,"name":"Malicious AI ‘skills’ turned agents into credential thieves, at scale"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/malicious-ai-skills-turned-agents-into-credential-thieves-at-scale-tbrzkmxef#faq","mainEntity":[{"@type":"Question","name":"How did the malicious AI skills on Vercel's skills.sh steal credentials from AI agents?","acceptedAnswer":{"@type":"Answer","text":"The malicious skills started clean to build trust and install counts, then had malicious instructions injected later. Those instructions told AI agents to locate SSH keys, cloud credentials, database logins, and access tokens, bundle them with machine details, and send them to attacker-controlled servers. Some skills also rewrote the agent's system prompt to reinstall themselves if deleted, or silently replaced Claude's built-in skill-creator with a malicious copy. Teams deploying AI agents track emerging attack patterns like this on daily.dev before they reach production."}},{"@type":"Question","name":"What does the AI agent skills supply chain attack mean for the definition of supply chain risk?","acceptedAnswer":{"@type":"Answer","text":"The attack expands supply chain risk for AI agents beyond code libraries to include skills, tools, MCP servers, and any web page an agent reads. Because a skill is just instructions and an agent's job is to follow instructions, the same obedience that makes agents useful becomes the attack surface — any content the agent consumes can carry instructions that make it act against its user. Developers building on AI agent frameworks keep up with this evolving threat surface on daily.dev."}}]} ```