Fake AI Agent Skill Bypasses Security Scans, Reaches 26,000 Agents in Supply Chain Attack Demo

Security firm AIR demonstrated a critical supply chain vulnerability in AI agent ecosystems by creating a fake skill named ‘brand-landingpage’ that bypassed all major security scanners, including those from Cisco, NVIDIA, and skills.sh. The skill, promoted via Instagram ads targeting marketers and salespeople, reached approximately 26,000 agents, including some on corporate accounts.

The skill exploited a structural blind spot: scanners only analyze the submitted package (SKILL.md and associated files), but the skill directed agents to an external URL (stitch-design.ai, controlled by AIR) for setup instructions. Initially, the URL pointed to legitimate Google Stitch documentation, passing all scans. After widespread installation, AIR swapped the page to instruct agents to download and run a script that collected user email addresses. This technique, previously demonstrated by Trail of Bits against ClawHub and other platforms, highlights that external content can be changed post-vetting.

Key trust signals—GitHub stars (borrowed via a merged pull request to a popular repository) and clean scanner verdicts—were easily manipulated. The researchers emphasize that skills should be treated as software, not text, and recommend vetting external links, pinning versions, enforcing least privilege, and re-checking skills when changes occur. While AIR’s 26,000-agent claim is unverified, the underlying method is independently confirmed, exposing a persistent gap in agent skill security.