Supply Chain - AI Skill Package Install From PyPI
This rule watches for package installer commands (pip, uv, pipx, poetry, pdm, conda) that pull down Python packages designed to inject instructions into an AI agent's context. It flags both a specific named package reported as suspicious and any package whose name follows a pattern typical of these 'skill' add-ons.
How the attack works
An attacker (or an unwitting user) runs a package installer to fetch a distribution that bundles a SKILL.md or similar instruction file meant for an AI agent. The rule inspects the installer's command line, either matching the exact name of a reported package (in its various PyPI name-normalization or filename forms) or matching a naming pattern like *-ai-skills, *-agent-skills, *-mcp-skills, or *-claude-skills. It fires at the moment the install command runs, before any agent has loaded or parsed the package's contents. This is earlier and narrower than detecting the agent actually reading and acting on a malicious skill file, which is a separate, later-stage detection.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 7c3f1a9e-2b64-4d5e-9a17-8f0c6d43be21
- Severity
- Medium
Why it matters
If a malicious skill package is installed and later loaded by an AI agent, it can inject unauthorized instructions into the agent's context, potentially steering its behavior or leaking data. This rule only catches the install step, not the eventual instruction injection, and it can't see installs driven by requirements or lock files, which don't show the package name on the command line.
What you can do
- →Review any install command matching the named package or the *-ai-skills/*-agent-skills/*-mcp-skills/*-claude-skills naming pattern and confirm the package's origin and purpose before it's used.
- →Maintain an allowlist of approved internal packages that follow this naming convention so CI pipeline noise doesn't mask real alerts.
- →Before any AI agent loads a newly installed skill package, inspect its SKILL.md or equivalent instruction file for unexpected directives.
- →Track requirements/lock-file-driven installs separately, since command-line based detection cannot see the package name in those cases.
Known benign look-alikes
- A bioinformatician or researcher legitimately installing biomedical-ai-skills for genuine cancer-bioinformatics work. The package is reported, not confirmed malicious - this is why the rule reports rather than blocks.
- CI pipelines (tox, nox, GitHub Actions, Docker builds) installing a first-party internal package that follows the *-agent-skills / *-ai-skills naming convention. Expect a steady low-volume baseline per build agent; tune by distribution name, not by relaxing the installer patterns.
- Security or triage staff pasting the package name into a shell to look it up. Mitigated by filter_readonly and filter_secdoc.
- Remediation commands uninstalling or purging the package. Mitigated by filter_removal.
- A developer running an editable or local-path install of their own skills package (pip install -e ., uv pip install ./pkg). Mitigated by filter_local on the family arm only.
- Dependency resolution checks (--dry-run, pip-compile, poetry lock, uv lock) that print a plan without installing. Mitigated by filter_dryrun and filter_lockonly.