Malicious Code in Skill Package
Attackers publish AI agent skill packages (files like SKILL.md and their bundled scripts) that contain hidden malicious code. Once installed, these skills can steal credentials, run malware, or hand over remote access to the attacker.
How the attack works
An attacker creates a skill package for an AI agent platform and embeds malicious code inside it, often obfuscated with base64 encoding or hidden in a password-protected ZIP to dodge static scanners. The package is published to a skill marketplace or repository, sometimes as one of many skills mass-produced by the same actor. A user or an agent installs the skill, believing it adds legitimate functionality. On execution, the hidden code runs — documented cases include delivering the AMOS infostealer and exfiltrating authentication tokens to achieve remote code execution.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 1b3bba78-e5f5-4be0-84ea-39a805bdbf1a
- Severity
- Critical
- CVEs
- CVE-2026-25253
Why it matters
An organization that installs a compromised skill can have credentials and auth tokens stolen, malware run on its systems, and remote access handed to the attacker — one confirmed case affected over 40,000 instances of a single agent platform.
What you can do
- →Review the source and publisher reputation of any AI agent skill before installing it, and prefer skills from known, verified publishers.
- →Inspect skill contents (SKILL.md and bundled scripts) for obfuscated code, base64 blobs, or password-protected archives before use.
- →Restrict which users or systems can install new skills, and require a review step for third-party or community-published skills.
- →Monitor installed skills for unexpected network calls, credential access, or execution of encoded/decoded payloads after installation.
Known benign look-alikes
- Legitimate installer scripts from known publishers (brew, nvm, rustup)
- Skills that discuss credential management as documentation
- Security training materials that describe archive extraction with passwords in an educational context (e.g., CTF walkthroughs mentioning 'password = infected123' near the word 'extract')