Weaponized Skill — Agent as Attack Tool
Some add-on 'skills' installed into AI agents are not productivity helpers but disguised attack tools. Once approved, they can silently download and run offensive code such as ransomware, exploit frameworks, or credential-cracking tools with no further user confirmation.
How the attack works
An attacker publishes a skill to a marketplace (such as skills.sh or ClawHub) or distributes it directly, presenting it as a normal capability. Once a user or organization approves the skill, the agent grants it standing permission to download code, execute it, read environment variables, and write files without prompting again — this is the 'consent gap.' The attacker uses that standing trust to pull in tools like SQLMap, Metasploit payloads, brute-force scripts, or full ransomware (a real case involved a modified Claude skill delivering MedusaLocker ransomware, disclosed to Anthropic in October 2025). Research (arXiv 2601.17548) shows such embedded attack tooling succeeds 41-84% of the time. The agent itself becomes the delivery and execution mechanism, acting on the attacker's behalf under the user's own credentials and environment access.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 9190c536-c7f5-4eda-a303-4350c67b269e
- Severity
- High
Why it matters
An organization can suffer ransomware deployment, credential theft, or unauthorized exploitation of internal and external systems, all launched through a tool it explicitly approved and trusted. Because the skill runs with the agent's existing permissions, the attack can reach environment secrets and file systems without triggering normal user prompts.
What you can do
- →Review all installed agent skills for what they actually download or execute at runtime, not just their stated description.
- →Require explicit, per-action approval for skills that execute code, read environment variables, or write files, rather than a one-time blanket consent.
- →Restrict skill installation to vetted internal sources; treat third-party marketplaces like skills.sh or ClawHub as untrusted until reviewed.
- →Monitor agent processes for unexpected outbound downloads, execution of known offensive tools (e.g., SQLMap, Metasploit), or unusual file writes following skill invocation.
Known benign look-alikes
- Authorized penetration testing skills with explicit scope controls
- CTF competition skills in sandboxed environments
- Defensive security skills that reference attack tools conceptually
- Security audit documentation that includes exact command examples from penetration testing reports for remediation guidance
- Academic cybersecurity coursework or textbooks quoting tool syntax in instructional contexts