Concept: Skill Poisoning
Skill Poisoning is a software supply-chain attack vector targeting agentic AI execution environments (such as claude-code and openclaw). In a skill poisoning attack, malicious actors distribute seemingly benign, functional agent skills that later mutate their external instructions to compromise host systems, exfiltrate credentials, or recruit agents into distributed swarm-attacks.
Mechanism of the Attack
Modern agentic coding and workflow tools rely on modular skill configurations (often defined in skill.md files; see agentic-skill-design and skill-loading-architecture). These files specify operational workflows, script harnesses, and external documentation URLs that the agent should consult during execution.
Because agents operate with delegated permissions (file system access, shell execution, network reachability) and obediently follow documented steps, external references introduce a critical vulnerability:
- Initial Trust Acquisition: The attacker authors a high-utility skill (e.g., a landing page generator or SDK integration tool) pointing to legitimate external documentation hosted on attacker-controlled infrastructure.
- Scanner & Registry Clearance: Automated security scanners (such as Cisco, Nvidia, or Vercel registry scanners) inspect the skill files. Because the static files contain no malware and the remote endpoints serve authentic documentation, the skill passes security checks and receives verified status.
- Distribution & Trust Accumulation: The skill accumulates thousands or millions of installs across developer communities.
- Endpoint Mutation & Payload Delivery: Weeks or months later, the attacker modifies the contents of the remote documentation page. The updated page instructs the agent to download and run malicious scripts or harvest credentials.
- Silent Execution: The agent treats the updated documentation as a legitimate instruction source within its authorized perimeter, exfiltrating SSH keys, cloud credentials, and API tokens without triggering standard anti-virus or ransom alerts
Notable Disclosures (August 2026)
- Zenity Labs Campaign: Disclosed at Black Hat 2026, a single poisoned skill family cleared over 1.7 million aggregate installs across developer registries despite automated multi-vendor scanning running since early 2026. Over 30% of malicious skills identified in the audit targeted Claude Code and OpenClaw environments for silent credential harvesting.
- AIR Security Demonstration: Security researchers demonstrated the ease of creating a clean Google Stitch design skill, merging it into a reputable GitHub marketplace repository, bypassing Cisco and Nvidia scanners, and subsequently re-pointing documentation endpoints to deliver scripts across 26,000 active agents.
Defensive Countermeasures
Guarding against skill poisoning requires moving beyond one-time static file scanning to runtime behavioral boundaries and strict dependency isolation:
- External Link Isolation: Agent harnesses must flag, isolate, or block any skill definition containing external URLs that are fetched dynamically at runtime.
- Continuous Daily Scanning: Registry maintainers and local harnesses must continuously re-verify remote URLs and pin remote content hashes rather than fetching dynamic web pages.
- Restricted Skill Sourcing: Treating third-party skills like unverified executables. Organizations must establish curated internal skill registries rather than installing community packages directly.
- Least-Privilege Execution Scoping: Enforcing strict agent-security-boundaries where design or research skills are strictly denied access to developer credentials, SSH keys, or cloud environment variables.