Security researchers from Zenity uncovered a supply chain attack targeting AI agent skills on the skills.sh marketplace. Attackers typosquatted on popular AI services Paperclip and Browser Use, uploading trojanized skills that accumulated 1.7 million installs between July 11 and August 2. The malicious skills exploited progressive discovery — a technique for managing LLM context windows — to hide credential-stealing instructions in a secondary setup file. After malicious npm and PyPI packages were removed within hours, attackers pivoted to serving the payload directly from attacker-controlled GitHub repositories. The credential stealer targeted SSH keys, cloud credentials, Git tokens, Kubernetes/Docker configs, and .env files on developer workstations, CI runners, and agent workspaces. Zenity also launched a free sandbox service called AI Total that detonates skills in a live agent environment to detect malicious behavior.
Questions this post answers
How did the trojanized AI agent skills attack on skills.sh work technically?
Attackers uploaded skills to skills.sh that initially passed marketplace checks by copying legitimate Paperclip and Browser Use skills verbatim. On July 11 they updated the skills with malicious instructions hidden in a secondary file called setup-installation.md, exploiting progressive discovery so the malicious command only triggered when an agent needed to install or start Paperclip. After npm and PyPI removed their rogue packages within hours, they redirected agents to install a credential stealer directly from attacker-controlled GitHub repositories. Developers running AI agent pipelines track emerging attack patterns like this on daily.dev.
What credentials and files did the AI agent skills supply chain attack target?
The credential stealer targeted SSH keys, cloud credentials, Git and package-manager tokens, Kubernetes and Docker configuration files, deployment platform credentials, database credentials, infrastructure-as-code tooling secrets, and project .env files. The collection logic was specifically aimed at developer workstations, CI runners, and agent workspaces — environments where these sensitive assets are commonly present and accessible. Teams securing CI runners and agent workspaces watch for threats like this on daily.dev.
What is AI Total and how does it detect malicious AI agent skills?
AI Total is a free sandbox service built by Zenity that applies malware detonation concepts to AI agent skills. It downloads a skill, activates it inside a live agent running in a sandbox environment stocked with decoy credentials and sensitive files, then monitors the agent's behavior — including what domains it contacts, what packages it downloads, what files it accesses, and what other actions it takes. This behavioral approach addresses the difficulty of using static analysis on natural-language skill files. Security teams evaluating AI agent tooling find coverage of new defensive tools on daily.dev.
315 Impressions1 Comment