# Skill Squatting / Typosquatting

- **Severity:** High
- **Signature ID:** `07374628-c4d2-4f96-a0e9-d561b8cfdbfa`
- **MITRE ATLAS:** AML.T0010 (AI Supply Chain Compromise)
- **OWASP:** ASI04 (Memory and Context Poisoning), LLM03 (Supply Chain)

## Summary

Attackers publish AI agent 'skills' (plugins/extensions) that claim to be official releases from well-known companies, but come from unverified publishers. This is a known technique for sneaking malware, such as infostealers, into environments where users trust the brand name and don't check who actually published the code.

## How the attack works

An attacker creates a skill with a name and description that sounds like it comes from a known publisher (e.g. claiming to be 'official' Anthropic, Vercel, Microsoft, GitHub, or Google tooling). The skill is uploaded under an unrelated, unverified publisher account rather than the real vendor's account. Users or agents search for or are recommended the skill, see the trusted brand name, and install it without checking the actual publisher. Once installed, the skill runs with whatever permissions the agent grants it, which has been used in documented cases to deliver infostealer malware.

## Why it matters

Organizations risk installing malicious code disguised as trusted vendor tooling, leading to credential theft or other malware execution inside agent environments.

## What you can do

- Verify the actual publisher account of any AI skill before installing, not just the name or description.
- Restrict skill installation to a pre-approved allowlist of verified publishers.
- Review already-installed skills for publisher mismatches against claimed brand affiliation.
- Treat any skill claiming 'official' status from a major vendor as suspicious unless it comes from that vendor's verified account.

## Known benign look-alikes

- Legitimate crypto/DeFi development tools (rare on skills.sh)

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00124

---
Source: https://www.netzilo.com/threats/atr-skill-squatting-typosquatting