--- title: The SKILL.md pattern is quietly solving AI context amnesia description: A security research firm called AIR shipped a malicious AI agent skill to 26,000 users, bypassing all major static scanners by exploiting a timing gap: the... canonical: https://daily.dev/posts/the-skill-md-pattern-is-quietly-solving-ai-context-amnesia-acj8bmnia twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: The SKILL.md pattern is quietly solving AI context amnesia | daily.dev og:description: A security research firm called AIR shipped a malicious AI agent skill to 26,000 users, bypassing all major static scanners by exploiting a timing gap: the... og:url: https://daily.dev/posts/the-skill-md-pattern-is-quietly-solving-ai-context-amnesia-acj8bmnia og:image: https://api.daily.dev/og/posts/AcJ8BMNiA.png og:image:alt: The SKILL.md pattern is quietly solving AI context amnesia og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # The SKILL.md pattern is quietly solving AI context amnesia **[Trends](https://daily.dev/sources/trends)** · 5 min read · 4 upvotes · 0 comments ## Summary A security research firm called AIR shipped a malicious AI agent skill to 26,000 users, bypassing all major static scanners by exploiting a timing gap: the skill initially pointed to a legitimate domain that was later flipped to serve a malicious payload. This exposes a fundamental flaw in point-in-time security scanning for skills, which are live dependencies that can mutate after approval. The SKILL.md ecosystem is growing rapidly — with Qt shipping CMake skills, Ruby gem tooling, and NuGet proposals to bundle skills in packages — but the distribution layer lacks a trust model that accounts for post-approval changes. The NuGet approach of shipping skills via trusted package managers is highlighted as a cleaner trust model. Practical advice mirrors early npm security guidance: treat third-party skills like shell scripts from strangers, review them carefully, and be wary of external URL references. ## Content Last week, a security research firm called AIR demonstrated something that should make anyone building with AI agents uncomfortable: they shipped a malicious skill to 26,000 users, and every major static scanner missed it. The mechanics are worth understanding. The skill looked legitimate because it piggybacked on a real, popular GitHub repository to build reputation. The domain it pointed to initially redirected to the actual site it claimed to be. Cisco, Nvidia, and skills.sh all scanned it and saw nothing wrong. Then, after distribution, AIR flipped the domain to serve a script payload. Game over. This is the core problem with point-in-time security scanning applied to things that can change after you approve them. A skill isn't a static artifact. It's a live dependency that can phone home, redirect, and mutate. Approving it once tells you nothing about what it does next Tuesday. ## The skills ecosystem is growing fast, and that's the problem The timing is awkward because the developer community is genuinely excited about AI skills right now, and for good reason. The pattern is elegant: write a SKILL.md file with YAML front matter and a markdown body, drop it in the right directory, and your coding agent arrives pre-briefed on whatever context you've encoded. No more spending tokens re-teaching Claude how your Rails migration conventions work, or explaining the Qt 6 CMake API from scratch every session. Qt just shipped a CMake skill for AI coding agents that embeds authoritative Qt 6 best practices directly into agent reasoning. The problem it's solving is real: LLMs default to Qt 5 patterns because that's what dominated their training data. A skill that corrects this before the agent produces output is genuinely useful. It's been tested with Claude Code and GitHub Copilot, and it does a pre-flight check for common mistakes before generating anything. There's also a growing cottage industry of tooling around skills. `gem-skill` generates SKILL.md files from Ruby gem documentation and caches them globally, so you run the ingestion once and symlink it into projects rather than re-reading READMEs every session. The NuGet ecosystem is seeing proposals to ship skills inside packages themselves, using MSBuild's buildTransitive mechanism to auto-copy a SKILL.md into the consuming repo at build time. The idea is that library authors know their API better than any LLM's training data does, so they should ship the correction directly. One developer on Bluesky called this "a material improvement over traditional skill creation and CI yaml file creation," which is the kind of low-key endorsement that signals something is actually working rather than just being hyped. ## The security gap nobody wants to talk about Here's where it gets uncomfortable. The same properties that make skills useful — they're small, they're markdown, they load context from external sources, they can reference live documentation — are exactly what makes them dangerous when they come from untrusted sources. The AIR attack worked because skills can point to mutable external URLs. The skill itself was clean. The domain it referenced wasn't, eventually. Static scanning caught neither the initial redirect nor the eventual payload swap because static scanning looks at the file, not at what the file will do over time. The security recommendations coming out of this are sensible but add friction: treat skills like third-party dependencies requiring continuous validation, pin versions, verify cryptographic hashes, enforce least-privilege, monitor runtime network behavior. All reasonable. All things that will slow down the "just download this skill from skills.sh" workflow that makes the ecosystem appealing in the first place. The guides currently circulating on how to use skills "like a senior developer" do mention security considerations when downloading third-party skills. But the advice is mostly "be careful" and "review what you're installing," which is the same advice we gave about npm packages in 2015. We know how that played out. ## What this actually means The skills pattern is solving a real problem. AI coding agents genuinely do better when they arrive pre-briefed on domain-specific context, and the SKILL.md format is a reasonable way to encode that. The Qt team shipping authoritative CMake knowledge as a skill, library authors bundling skills with their packages, developers maintaining personal skill libraries for their own conventions — all of this makes sense. But the distribution layer is where things get messy. A marketplace of community-contributed skills is only as trustworthy as its vetting process, and AIR just demonstrated that the current vetting process has a timing problem it can't solve with static analysis alone. The NuGet approach — skills shipped by the library author, installed via the package manager you already trust — sidesteps most of this. If you trust the package, you trust the skill. That's a cleaner trust model than "someone uploaded this to a marketplace and three scanners didn't flag it." For now, the practical advice is boring but correct: treat third-party skills the way you'd treat a shell script from a stranger's GitHub. Read it. Understand what it's doing. Be suspicious of anything that references external URLs. And remember that what it does today isn't necessarily what it'll do after the next DNS update. ## Questions this post answers ### How did the malicious AI skill demonstrated by AIR bypass security scanners? It piggybacked on a real, popular GitHub repository to build reputation and initially pointed to a domain that redirected to the legitimate site it impersonated. Cisco, Nvidia, and skills.sh all scanned it and found nothing wrong. After distribution to 26,000 users, the domain was flipped to serve a malicious script payload, which static, point-in-time scanning could not detect. _Teams vetting AI agent skills before adoption can track supply-chain security research like this on daily.dev._ ### What is the SKILL.md pattern for AI coding agents? It is a file format combining YAML front matter with a markdown body that pre-briefs a coding agent with domain-specific context, so developers stop spending tokens re-explaining conventions like Rails migration patterns or the Qt 6 CMake API every session. Qt shipped a CMake skill tested with Claude Code and GitHub Copilot to correct agents defaulting to outdated Qt 5 patterns from their training data. _Developers building reusable context for coding agents can follow SKILL.md tooling developments on daily.dev._ ### Why is NuGet's approach of shipping skills inside packages considered more secure than downloading skills from a marketplace? NuGet proposals use MSBuild's buildTransitive mechanism to auto-copy a SKILL.md into a consuming repo at build time, meaning the skill arrives from the library author through a package manager the developer already trusts, rather than from an unvetted marketplace. This sidesteps the timing problem where a skill can pass static scanning and later mutate via a redirected external domain. _Developers weighing trust models for AI agent context can track ecosystem security patterns like this on daily.dev._ ## Similar posts on daily.dev - [A fake AI agent skill passed every security scanner and reportedly reached 26,000 agents](https://daily.dev/posts/a-fake-ai-agent-skill-passed-every-security-scanner-and-reportedly-reached-26-000-agents-bdcaqioyv) · The Next Web · 0 upvotes · 0 comments - [Auditing Agent Skills: A Threat Model for the Next Generation of AI Package Managers](https://daily.dev/posts/auditing-agent-skills-a-threat-model-for-the-next-generation-of-ai-package-managers-vxdluywso) · DEV · 9 upvotes · 0 comments --- Tags: [#ruby](https://daily.dev/tags/ruby), [#ai-coding](https://daily.dev/tags/ai-coding), [#context-engineering](https://daily.dev/tags/context-engineering) [View this post on daily.dev](https://daily.dev/posts/the-skill-md-pattern-is-quietly-solving-ai-context-amnesia-acj8bmnia) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"The SKILL.md pattern is quietly solving AI context amnesia","url":"https://daily.dev/posts/the-skill-md-pattern-is-quietly-solving-ai-context-amnesia-acj8bmnia","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/the-skill-md-pattern-is-quietly-solving-ai-context-amnesia-acj8bmnia"},"datePublished":"2026-06-19T01:26:01.710Z","dateModified":"2026-09-13T19:13:33.143Z","description":"A security research firm called AIR shipped a malicious AI agent skill to 26,000 users, bypassing all major static scanners by exploiting a timing gap: the...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/31e3023be5f6174ae978f6dfa2cb012c?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/31e3023be5f6174ae978f6dfa2cb012c?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Trends","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Trends","logo":"https://media.daily.dev/image/upload/s--ZfSp3asX--/f_auto,q_auto/v1780996004/logos/trends?_a=BAMAMiWQ0","url":"https://daily.dev/sources/trends"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/the-skill-md-pattern-is-quietly-solving-ai-context-amnesia-acj8bmnia","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":4},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"ruby,ai-coding,context-engineering","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Trends","item":"https://daily.dev/sources/trends"},{"@type":"ListItem","position":3,"name":"The SKILL.md pattern is quietly solving AI context amnesia"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/the-skill-md-pattern-is-quietly-solving-ai-context-amnesia-acj8bmnia#faq","mainEntity":[{"@type":"Question","name":"How did the malicious AI skill demonstrated by AIR bypass security scanners?","acceptedAnswer":{"@type":"Answer","text":"It piggybacked on a real, popular GitHub repository to build reputation and initially pointed to a domain that redirected to the legitimate site it impersonated. Cisco, Nvidia, and skills.sh all scanned it and found nothing wrong. After distribution to 26,000 users, the domain was flipped to serve a malicious script payload, which static, point-in-time scanning could not detect. Teams vetting AI agent skills before adoption can track supply-chain security research like this on daily.dev."}},{"@type":"Question","name":"What is the SKILL.md pattern for AI coding agents?","acceptedAnswer":{"@type":"Answer","text":"It is a file format combining YAML front matter with a markdown body that pre-briefs a coding agent with domain-specific context, so developers stop spending tokens re-explaining conventions like Rails migration patterns or the Qt 6 CMake API every session. Qt shipped a CMake skill tested with Claude Code and GitHub Copilot to correct agents defaulting to outdated Qt 5 patterns from their training data. Developers building reusable context for coding agents can follow SKILL.md tooling developments on daily.dev."}},{"@type":"Question","name":"Why is NuGet's approach of shipping skills inside packages considered more secure than downloading skills from a marketplace?","acceptedAnswer":{"@type":"Answer","text":"NuGet proposals use MSBuild's buildTransitive mechanism to auto-copy a SKILL.md into a consuming repo at build time, meaning the skill arrives from the library author through a package manager the developer already trusts, rather than from an unvetted marketplace. This sidesteps the timing problem where a skill can pass static scanning and later mutate via a redirected external domain. Developers weighing trust models for AI agent context can track ecosystem security patterns like this on daily.dev."}}]} ```