The software supply chain has a new blind spot. And it’s not in npm, PyPI, or Docker Hub. It’s in the AI agent skills your developers are installing right now. This isn’t just a bug or a misconfiguration — it’s an AI agent supply chain attack hiding in plain sight, and most security teams haven’t started monitoring for it yet.
Researchers at Zenity Labs dropped a bombshell at Black Hat USA 2026: a trojanized family of AI agent skills had quietly accumulated more than 1.7 million installs on Vercel’s public skills.sh marketplace before anyone noticed. The payload? A credential stealer targeting SSH keys, cloud tokens, and CI runners. The delivery mechanism? Not a supply chain compromise of a trusted library, but something far more insidious — a skill that looked legitimate until it suddenly wasn’t.
If you thought the days of npm-style typosquatting were behind us, think again — our coverage of a malicious npm package campaign shows the same pattern is still very much alive. The attackers didn’t break into a package registry. They simply uploaded skills, built trust while they were clean, and then flipped a switch — a classic pattern now repurposed for this emerging attack surface.
The Discovery: An AI Agent Supply Chain Attack at 1.7 Million Installs
Zenity Labs uncovered the campaign in late July, but the groundwork was laid weeks earlier. The attackers cloned popular skills for two widely-used AI agent platforms — Paperclip and Browser Use — and uploaded typosquatted look-alikes to skills.sh. These weren’t crude impersonations. They worked exactly like the real thing. And because they worked, people installed them.
Here’s where it gets really clever. The skills weren’t malicious on day one. They sat in the marketplace, clean and functional, racking up installs and climbing the trending list. On July 11, the attackers trojanized the skills — injecting instructions that directed AI agents to fetch and install a credential-stealing payload from GitHub.
By August 2, the affected skill family had surpassed 1.7 million aggregate installs. Zenity is careful to note that this figure represents total downloads, not unique users. Still, the scale is staggering. Even if a fraction of those installs translated to active execution, the blast radius is enormous.
The payload itself was surgical. When an agent loaded one of these compromised skills, it received new instructions: install a credential harvester, scan for SSH private keys, cloud provider tokens, and CI/CD secrets, and exfiltrate them. All of this executed within the agent’s normal operating context, cloaked in the implicit trust that users place in skills they’ve already been using successfully.
Why Agent Skills Are the New Frontier for AI Agent Supply Chain Attacks
To understand why this attack vector is so dangerous, you have to understand what an AI agent skill actually is.
A traditional software package — think an npm module or a Python wheel — is largely code. It exposes functions. You import it, call it, and hopefully read the source or trust the maintainer. Security scanners can analyze the code. Static analysis can flag suspicious patterns. The threat model, while imperfect, is at least somewhat understood.
Agent skills are different. They are hybrid artifacts: part executable code, part natural language instructions. A skill might contain a Python script, but it also contains a SKILL.md file telling the agent when to use the skill, what arguments to pass, and how to interpret the results. The agent doesn’t just execute the code — it reasons about when to invoke it.
This creates a fundamentally different trust model. When you install a skill, you’re not just trusting a piece of code. You’re trusting a piece of text that tells your AI agent — which may have broad system access — how and when to act. That text can contain prompt injection, hidden instructions, or semantic manipulations that no traditional code scanner will catch.
The implicit trust problem is compounded by marketplace dynamics. skills.sh and similar registries operate like app stores: anyone can publish, discovery is driven by popularity and trending algorithms, and the vetting is minimal to nonexistent. A skill with a hundred thousand installs carries social proof. Users see the number and assume safety. Attackers know this, and they exploit it ruthlessly. This is what makes the AI agent supply chain attack such a potent threat — and why agent plugin security vulnerabilities in these marketplaces are especially concerning.
How the Attack Works
The Zenity campaign is a masterclass in patience and exploitation of platform mechanics. Let’s walk through the execution path.
Step 1: Typosquatting and Initial Seeding
The attackers identified high-traffic skills on skills.sh for Paperclip and Browser Use — legitimate tools that extend AI agents with browser automation and context management capabilities, similar in spirit to the autonomous agent tooling covered in our MOSAIC attack research. They created look-alike skills with similar names, uploaded clean, functional versions, and let organic installs accumulate.
Step 2: Building Social Proof
By trending organically, these skills gained the appearance of legitimacy. Users searching for Paperclip or Browser Use skills would see these high-install-count options near the top of results. The install count became a self-reinforcing signal: more installs meant higher rankings, which meant more installs.
Step 3: The Trojanization Event
On July 11, the attackers updated the skills with a seemingly innocuous change. Buried in the natural language instructions — the SKILL.md directives that tell the agent what to do — was a new command: fetch and install an additional package from a GitHub repository.
The agent, following its instructions dutifully, would:
- Receive the updated skill metadata
- Parse the new instructions as part of its operational directives
- Execute the tool call to download the secondary payload
- Run the credential stealer within the agent’s execution context
- Harvest secrets from the local environment and CI systems
- Exfiltrate them to attacker-controlled infrastructure
Step 4: Persistence Through Distribution
Because the skills were already installed across thousands of agent instances, the update propagated through normal skill refresh mechanisms. Users didn’t need to manually install anything new. Their existing skills simply turned malicious.
The technical elegance here is worth underscoring. This wasn’t a buffer overflow or a SQL injection. It was a supply-chain poisoning attack that weaponized the agent’s own reasoning process against its user. This is the hallmark of an AI agent supply chain attack: weaponizing trust rather than exploiting code — a pattern that echoes the symlink-based GhostApproval vulnerability we covered in AI coding assistants, where the agent’s own helpfulness became the attack vector.
Who’s at Risk
If your organization uses AI copilots, coding agents, or autonomous development tools, you’re in the blast radius. But some scenarios carry disproportionate risk.
Enterprises with Widely Deployed AI Agents
Companies that have rolled out AI coding assistants or autonomous agents to development teams face the most exposure. A single compromised skill installed across a hundred developer workstations becomes a hundred potential credential leaks. When those credentials include AWS tokens, GitHub PATs, or Kubernetes service accounts, the lateral movement potential is catastrophic.
Developers Importing Third-Party Skills
Individual developers are often early adopters. They install skills from marketplaces to extend Claude Code, Cursor, OpenClaw, or similar tools. They rarely audit what they’re installing. A skill that promises “enhanced browser automation” or “better context memory” looks benign and useful. The fact that it might also be exfiltrating their .env files never crosses their mind.
CI/CD Pipelines with Agent Integrations
Perhaps the most dangerous scenario: AI agents integrated into CI/CD workflows. If a build pipeline uses an agent skill to automate testing, deployment, or documentation generation, and that skill is compromised, the attacker gains access to the CI runner’s environment. That environment is typically a treasure trove of secrets — deployment keys, registry tokens, signing certificates.
Low-Code and No-Code Platforms
Platforms that embed AI agent capabilities for non-technical users are also vulnerable. These users have the least ability to audit what they’re installing and often the least organizational oversight. A malicious skill on a low-code platform could siphon data from integrated SaaS tools without anyone noticing.
Detection and Prevention Strategies: How to Secure Third-Party AI Skills
The Zenity discovery isn’t just a headline — it’s a wake-up call. Here’s what security teams and developers can do right now to defend against an AI agent supply chain attack.
Audit Before You Install
Treat every skill like a privileged user account. Before installing any third-party skill:
- Read the
SKILL.mdfile thoroughly, not just the marketing description - Check the publisher’s identity and history
- Review the skill’s permissions and tool access
- Look for recent updates with minimal changelogs, especially after a skill has been stable for a while
If a skill suddenly adds a dependency on an external GitHub repo after months of no changes, that’s a red flag.
Monitor Agent Behavior
AI agents make tool calls. Log them. If an agent suddenly starts making unexpected network requests, downloading packages, or accessing sensitive file paths, that behavior should trigger an alert. Behavioral monitoring for agents is still nascent, but it’s rapidly becoming essential.
Pin Skill Versions
Just as you pin package versions in package.json or requirements.txt, pin your agent skills. Don’t let skills auto-update without review. The trojanization event in the Zenity campaign relied on users accepting updates to previously trusted skills. Version pinning would have prevented the malicious instructions from reaching already-deployed agents.
Demand Marketplace Accountability
The current marketplace model for agent skills is broken. skills.sh, ClawHub, and similar registries need:
- Mandatory code and instruction review before publication
- Cryptographic signing of skill packages
- Transparency into update history and changelogs
- Behavioral analysis in sandboxed environments before approval
Zenity Labs itself is pushing in this direction. At Black Hat, they announced AI Total, a free threat intelligence service that runs agent skills in contained environments and reports their actual runtime behavior. Tools like this should be table stakes, not novel announcements.
Segment Agent Environments
Never run an AI agent with unfettered access to production secrets. Use environment segmentation, short-lived tokens, and principle of least privilege. If an agent only has access to the specific credentials it needs for its immediate task, a compromised skill’s damage is contained.
The Bigger Picture: AI Agent Supply Chain Attack Trends in 2026
The Zenity campaign is not an isolated incident. It’s a signal that the threat landscape around AI agents is maturing — and not in a good way.
Earlier this year, researchers documented the ClawHavoc campaign targeting OpenClaw’s ClawHub marketplace, and Snyk’s comprehensive audit of the agent skills ecosystem found that 13% of recently installed skills contained critical security flaws, with 36% containing prompt injection vulnerabilities. The numbers aren’t edge cases. They’re systemic — and they sit alongside a wider wave of AI supply-chain incidents we’ve tracked, including the llms.txt documentation-poisoning attack that turns AI agents against their own trust in written instructions.
Academic researchers have formalized the threat in a growing body of literature. Papers now document “semantic supply-chain attacks” that manipulate SKILL.md files to hijack agent decision-making without injecting traditional code payloads. OWASP has recognized the threat, adding malicious skills to its emerging Agentic Skills Top 10.
What makes this moment particularly volatile is the speed of adoption. Enterprises are deploying agentic workflows faster than security practices can adapt. The gap between “we have AI agents in production” and “we have a security model for AI agents” is widening, and attackers are exploiting it.
The Black Hat USA 2026 timing is apt. A decade ago, the conference was sounding alarms about npm package hijacking and PyPI typosquatting. Those warnings were largely ignored until high-profile incidents forced the industry to build better tooling. We’re at the same inflection point with agent skills, except the stakes are higher — because a compromised agent skill doesn’t just run bad code. It instructs an intelligent system to decide to run bad code, and to hide that decision inside the normal flow of automated reasoning.
As the ecosystem pushes toward agent interoperability standards and cross-platform skill sharing, the attack surface will only expand. The question isn’t whether we’ll see more trojanized skills. We will. The question is whether the industry learns from this 1.7-million-install wake-up call — or waits for the next one to be measured in tens of millions.
Bottom Line
If you thought supply-chain security was solved, you were wrong. The battlefield has simply moved upstream — from the packages your code imports to the instructions your AI agent follows. The Zenity Labs discovery proves that attackers have already figured out how to exploit this new layer, and they’re doing it at scale. Understanding and defending against the AI agent supply chain attack is no longer optional.
The good news is that the fundamentals of supply-chain security still apply: verify what you install, monitor what runs, pin your versions, and demand transparency from platforms. The bad news is that most organizations haven’t started applying those fundamentals to their agent ecosystems yet.
You should start now. Before your skills install count reaches 1.7 million.
References and further reading
Please let us know if you enjoyed this blog post. Share it with others to spread the knowledge! If you believe any images in this post infringe your copyright, please contact us promptly so we can remove them.