In a recent eye-opening experiment, a security firm, AIR, successfully demonstrated the vulnerability of AI agent skills to malicious infiltration. By creating a fake skill, they exposed the limitations of current security measures and the potential risks associated with trusting these skills blindly.
The experiment began with AIR pushing a seemingly harmless skill through a popular marketplace and an Instagram ad, reaching an alarming number of 26,000 agents, including some with corporate accounts. What makes this particularly fascinating is the fact that every security scanner tested by the firm marked this skill as safe. This raises a deeper question about the reliability of these scanners and the trust we place in them.
The Trust Problem
A skill, as explained, is a set of instructions that an agent follows with a certain level of authority, akin to a user prompt. The issue lies in the inherent trust placed in these skills, which is precisely why skill-scanning tools exist. AIR's skill, named "brand-landingpage," cleverly exploited this trust by claiming to build a landing page using Google's Stitch design tool, targeting non-technical users. By manipulating trust signals, such as GitHub stars and clean scanner verdicts, AIR managed to make their skill appear credible.
How Scanners Missed the Threat
The scanners tested by AIR, including those from Cisco and NVIDIA, analyze the package submitted to them, which includes the SKILL.md and accompanying files. However, AIR's skill had no setup instructions of its own. Instead, it directed agents to install the "Stitch SDK" by following external documentation, leading the scanners to believe it was a legitimate process. Initially, the scanners cleared the skill as safe, as the package appeared clean and pointed to a plausible setup page. But here's where it gets interesting: once the skill was widely installed, AIR swapped the page, instructing agents to download and run a script. This script, in the demo, simply mailed the user's address back to AIR, but a real attacker could have exploited this foothold for more malicious purposes.
A Known Issue, a Structural Problem
AIR is not the first to demonstrate this vulnerability. Trail of Bits, in a similar experiment, bypassed multiple scanners, including ClawHub's detector. Their conclusion was straightforward: scanners check a fixed package, while attackers can continuously tweak their payload until it passes. This issue is structural; the scan happens once, but the external links a skill points to can be manipulated at any time. Anthropic's own documentation warns about the risks of skills fetching external URLs, as the content can change post-vetting. Research this year further highlights the disagreement among scanners, as they judge skills in isolation, blind to external links and post-review changes.
What Defenders Should Do
The solution lies in treating skills as software, not just text. Defenders must vet what a skill points to, not just the contents of the package. Most add-ons are installed with no review, so the first step is identifying what's already running. Route new skills through a controlled source and re-check them regularly. Pin versions, limit agent privileges, and assume any external instruction an agent fetches runs with its access. While the scale of AIR's experiment may be questionable, the method and the vulnerabilities it exposes are very real.
Conclusion
This experiment serves as a stark reminder of the potential risks associated with AI agent skills and the need for more robust security measures. As an expert in this field, I believe it's crucial to approach these skills with a healthy dose of skepticism and implement rigorous vetting processes. The trust signals currently relied upon are clearly insufficient, and we must adapt our security strategies to keep pace with evolving threats. The gap exposed by AIR's experiment is a wake-up call for the industry, and it's time to address these vulnerabilities head-on.
