What makes agent skill supply chain attacks different from npm or PyPI package attacks?

Standard package supply chain attacks embed malicious code that executes when imported or installed. Agent skill attacks are different because the payload is natural-language instructions in a SKILL.md file, which the AI agent parses and follows as operational directives. The skill doesn't need executable code to cause harm: a SKILL.md file that tells an agent to exfiltrate API keys on certain triggers is just text, and it bypasses any code scanner looking for suspicious imports or system calls.

How does VulMask evade automated skill scanners?

VulMask rewrites overt malicious code into implementations that look like ordinary security vulnerabilities: hardcoded credentials, SQL injection sinks, insecure deserialization patterns. These are red flags in any codebase, but not the malware signatures that scanners look for. The malicious behavior only activates under specific attacker-controlled trigger conditions, so the skill passes static analysis while remaining fully weaponised. Automated reviewers across all tested coding agents failed to flag VulMask-encoded payloads.

What defensive controls work against agent skill supply chain attacks?

No single control is sufficient. The effective combination is: a private or verified skill registry rather than consuming from public marketplaces without review; allowlisting of approved skills at the agent configuration layer; sandboxed execution environments that limit what skills can access at runtime; and runtime monitoring for anomalous agent actions like unexpected file reads or network connections. SKILL.md files should be treated with the same scrutiny as third-party code dependencies.

PhantomSkill: How Agent Skill Registries Became a Supply Chain Risk

When security teams audit their software supply chain, they check npm packages, PyPI dependencies, container base images, and GitHub Actions. Almost nobody audits their AI agents’ skill libraries, and that gap has been open long enough for researchers to document the exploitation techniques in detail.

In June 2026, Lin and Yu published PhantomSkill, a supply-chain attack framework targeting AI coding agent skill ecosystems. The core technique, VulMask, transforms malicious payloads into code that looks like ordinary security vulnerabilities. It doesn’t look like malware. It looks like a developer writing slightly insecure code. Automated scanners pass it. Automated reviewers miss it. And when an attacker-controlled trigger fires, it executes.

What agent skills are and why they matter

Anthropic introduced the SKILL.md format as a way to package reusable capabilities for Claude Code: a directory with a SKILL.md instruction file and optional auxiliary resources like scripts and templates. An agent that loads a skill inherits its behavioral instructions as part of its operational context. Other agentic platforms have adopted similar patterns under different names. The point is the same: skills are how you extend what an agent can do without rewriting its base prompt.

The security implication follows directly. Agents with loaded skills have those skills’ instructions in context at the moment they hold file system access, shell execution privileges, and network access. A skill that contains malicious instructions isn’t a script to quarantine. It’s an operational directive the agent will follow.

Skills are distributed through registries. ClawHub is the primary public registry for Claude Code skills. Publishing requires a SKILL.md file and a GitHub account that is one week old. There is no code signing. There is no sandboxing at install time. There is no security review.

What Snyk’s audit found

Snyk published an audit of 3,984 skills from the ClawHub registry in February 2026. The numbers are not good. 36.82 per cent of audited skills contained at least one security flaw. 13.4 per cent carried critical-severity issues. 76 skills contained confirmed malicious payloads, including credential theft routines, backdoor installation sequences, and data exfiltration targeting cloud API keys and environment variables.

Those 76 skills weren’t immediately obvious. That’s the point. Many were functional, legitimate-looking skills for common workflows that had malicious logic embedded in their auxiliary resource files, not in the SKILL.md description where humans and reviewers focus.

The VulMask technique

PhantomSkill’s contribution is formalising how to get malicious code past automated and human review. VulMask works by rewriting a malicious script into an implementation whose surface characteristics match a vulnerable-but-not-malicious pattern. An exfiltration function gets rewritten to look like an SQL injection sink. A command execution payload gets restructured to look like a path traversal vulnerability. The intent is malicious; the signature looks like bad coding practice.

The distinguishing factor from overt malware: VulMask payloads only activate under attacker-controlled conditions. Reaching an external endpoint, a specific environment variable being present, a date condition. Static scanners that look for malicious behavior in execution see nothing unusual. The payload sits dormant until triggered.

Across all tested coding agents and automated reviewers, VulMask-encoded skills produced fewer malware-level warnings than their openly malicious equivalents, while maintaining the same capability to exfiltrate credentials, install backdoors, or execute arbitrary commands.

The SKILL.md semantic attack surface

Separate research from the CSA AI Safety Initiative frames the structural problem as “agent context poisoning.” SKILL.md files function as operational directives. The agent doesn’t distinguish between instructions from a verified developer and instructions from a SKILL.md file someone pushed to ClawHub last week. They are equally trusted as part of the agent’s context.

This is the same trust relationship that makes prompt injection work at scale. AGENTS.md in a repository, SKILL.md in a skill registry, tool descriptions in an MCP server: all of these are text that the agent consumes and follows. Any of them can be adversarially authored.

The “Under the Hood of SKILL.md” paper (arxiv, May 2026) demonstrated semantic supply chain attacks that manipulate skill behavior through description-level instructions rather than embedded code. A skill that tells an agent to “always include file listings in responses” doesn’t trigger any malware scanner. It does cause every agent response to leak directory structures to wherever the agent sends output.

What this means in practice

A coordinated attack in late January through early February 2026 saw attackers publish over 1,200 malicious skills to the OpenClaw marketplace. The skills deployed the AMOS credential stealer, targeting developers who installed them to extend their coding agent capabilities. ClawHub and OpenClaw skills are additive to the attack surface already created by the MCP server ecosystem; teams that have audited their MCP servers may not have looked at their skill installations.

Two CVEs in Claude Code document the adjacent risk from repository-level configuration files: CVE-2025-59536 (CVSS 8.7) and CVE-2026-21852 (CVSS 5.3) both demonstrate that files an agent treats as configuration can trigger arbitrary command execution and API key exfiltration before any user interaction.

What to do

The defensive posture for agent skills is the same posture that took years to establish for open-source dependencies: don’t trust what you haven’t verified, and verify at more than one layer.

Maintain a private or curated skill registry rather than pulling from public sources. Review SKILL.md files and auxiliary resources with the same attention given to third-party code, not just the text description but the scripts and templates bundled with them. Scope agent execution permissions so skills can’t access credentials or network endpoints they don’t need. Monitor agent runtime behavior for anomalous patterns: unexpected file reads, outbound connections to new endpoints, environment variable access outside normal task flow.

The attack surface is real and the techniques to exploit it are documented and in use. The supply chain problem took a decade to take seriously for software packages. Agent skills are starting from a lower baseline.