Trojanized AI skills racked up 1.7 million installs before anyone noticed
Trojanized AI skills racked up 1.7 million installs before anyone noticed
Attackers don’t need to breach your perimeter when they can convince your AI agents to unlock the door from inside. Zenity researchers found a campaign that hid malicious instructions inside shareable AI agent skills — text files that tell large language models how to use specific tools. The trojanized skills, uploaded to the skills.sh marketplace, were downloaded more than 1.7 million times before the supply chain attack was detected.
The bait: legitimate skills swapped for malicious ones
The operation started in early July. Threat actors created GitHub organizations impersonating the maintainers of Paperclip, an AI agent orchestration platform, and Browser Use, a browser automation service for agents. They uploaded clean copies of the official skills to skills.sh, a marketplace maintained by Vercel. Days later, they updated those same skills with instructions directing AI agents to download a credential stealer from attacker-controlled GitHub repositories.
The malicious payload targeted developer workstations, CI runners, and agent workspaces. It hunted for SSH keys, cloud credentials, Git and package-manager tokens, Kubernetes and Docker configuration, deployment platform credentials, database connection strings, infrastructure-as-code tooling, and project .env files.
Why the attack worked
Skills aren’t always single files. They can be collections where a main file acts as a table of contents, pointing the agent to secondary documents for specific tasks. This progressive discovery pattern keeps context windows lean. The attackers hid the malicious command in setup-installation.md, a secondary file the agent would only open when Paperclip needed to be installed or started.
The skills also explicitly told agents to ignore npm and PyPI and pull only from the attacker GitHub release. Both registries had already flagged and removed the trojanized packages the attackers tried to publish there, so the pivot to direct GitHub installs was a fallback that worked.
Static analysis won’t catch this
Skills and MCP definitions are natural language instructions, not code snippets. Deciding whether a set of English sentences is malicious is a classification problem that static tools handle poorly. The Zenity researchers built a free service called AI Total that borrows the malware detonation concept: it activates a skill inside a live agent running in a sandbox with decoy credentials and full network monitoring, then watches what the agent actually does.
What this means for African enterprises
Agentic workflows are entering African fintech and enterprise environments faster than the security tooling to govern them. Skills marketplaces, MCP servers, and agent orchestration platforms are all part of a software supply chain most organizations don’t yet monitor. One compromised skill can turn every agent in your fleet into a credential harvester.
eHawu operates at the network layer. It doesn’t inspect prompt injections or skill definitions. It ensures that even if an agent is compromised, the traffic it generates can’t reach your crown jewels without traversing an encrypted, authenticated tunnel you control. Network segmentation enforced by cryptography, not by hoping the agent follows the rules.
Tags: #AISecurity #SupplyChainAttack #AgenticWorkflows #CredentialTheft #eHawuVPN
