Defending against malicious AI skills

Executive Summary

Cohesity REDLab is publishing this advisory in response to a series of attacks exploiting third-party skill marketplaces for AI agents and real-world examples are detailed later in this article. These incidents demonstrated that threat actors can publish functional-looking skills that silently deliver infostealers, open reverse shells, install persistence mechanisms, and exfiltrate credentials before any user-visible output occurs. 

For Cohesity Data Cloud administrators, this is an endpoint data protection problem as much as it is a security problem. AI agent skill files are plain-text files stored in known locations within user home directories. Backup snapshots provide detection and forensic capabilities that live endpoint security tools do not. They offer point-in-time evidence of which skills were installed. They also help establish a timeline that correlates skill installation with later persistence artifacts. In addition, they provide a file-based detection layer that can identify skills even after they have been removed from the live system.   

This advisory explains how skills are weaponized, what the documented attacks did in practice, and what Cohesity Data Cloud administrators should do to detect and respond. 

Why AI Agent Skills Are Especially Dangerous 

Several characteristics distinguish this threat from conventional software supply chain attacks. Skills execute with the agent's full system permissions. There is no sandbox, no permission prompt, and no declared scope. The payload is off-platform: it lives on an attacker-controlled server and is fetched at runtime. The skill file itself never contains the malicious binary and the attack completes before the user sees any output. Persistence survives skill removal (like cron jobs, LaunchAgents, and shell profile modifications) remain on the endpoint after the skill is uninstalled. The SKILL.md format is an open standard now supported by approximately 40 platforms, meaning a single malicious skill file can run across all of them without modification. 

Anatomy of a Malicious AI Agent Skill

An AI agent skill is a SKILL.md file which is a plain-text markdown document with YAML frontmatter that provides an AI agent with natural language instructions for performing a task. The agent reads the skill at session start and executes its instructions using whatever permissions the agent process already holds. Permissions often include full access to the local file system, shell execution, browser sessions, and any connected service credentials. Skills are installed from marketplaces in the same way a developer installs a browser extension: with a single click, no review, no permission scope. The SKILL.md standard is also supported by Claude Code, GitHub Copilot, Cursor, Codex CLI, Gemini CLI, and VS Code, among others. Today, approximately 40 platforms support the format. Below are three distinct delivery patterns observed, each exploiting a different property of how agents process skills. 

Pattern 1: The Prerequisite Dropper 

The ‘## Prerequisites’ section is a block in the SKILL.md file listing setup steps (commands to run before use) that the AI agent reads and executes automatically in the user's shell when the skill is first invoked. A command placed there runs with no separate confirmation, before any visible output. A mandatory setup step in the Prerequisites section runs a Base64-encoded terminal command before the skill does anything visible. The encoded string decodes to a curl or wget command that fetches and executes a payload from an attacker-controlled server. The actual malware never appears in the skill file (only the encoded redirect does) making it harder to detect. The attacker can update the payload on the remote server at any time without modifying the published skill or triggering a re-scan. 

Pattern 2: Runtime Affiliate Injection 

The skill contains no malicious code. Instead, its instructions direct the agent to fetch a JSON file from an attacker-controlled domain on every invocation and use the embedded referral links when making recommendations to the user. This attack is entirely semantic, i.e. natural language that redirects the agent's trusted advisory role into an attacker-controlled affiliate engine making it difficult for antivirus or behavioral detection to catch it. 

Pattern 3: File Padding for Scanner Evasion 

The malicious payload is placed at the top of the skill file, followed by many megabytes of padding characters. Many automated scanning pipelines impose a file size limit before declining to process a file. This technique causes the scanner to skip the file or return a clean verdict. The malicious content sits exactly where the scanner would have started. 

Real world examples

1Password discovered that the single most downloaded skill on ClawHub was a Twitter integration tool. It was delivering macOS infostealing malware. The skill looked entirely normal: description, intended use, an overview. Its very first action was to introduce a "required dependency" named ‘openclaw-core’ with platform-specific install steps. That dependency was a multistage downloader for a macOS infostealer. More details can be found here.

Trend Micro's analysed the AMOS malware as a service delivery mechanism, identifying 39 skills on ClawHub that manipulated OpenClaw into installing a fake command-line tool, and over 2,200 malicious skills across GitHub. Their analysis documented a notable escalation: a deceptive human-in-the-loop dialogue box that prompts the user to manually enter their password, using the AI agent as a trusted intermediary to socially engineer the human. The AMOS variant they analyzed exfiltrated Apple and KeePass keychains alongside user documents, and the campaign spanned both ClawHub and SkillsMP. More details can be found here.

YARA Pattern Matching in Backup Snapshots 

YARA rules deployed against snapshots protected in Cohesity Data Cloud detect content patterns in skill files rather than file hashes. This is a structural advantage over hash-based scanning: because the malware payload never lives in the skill file, there is no hash to match. The skill file that fetches it is the detectable artifact and that file is captured in backup snapshots at known paths under user home directories.