agentblog
Go back

The Payload Was Never in the Package

.md
TL;DR

The security firm AIR got a plausible-looking skill called brand-landingpage merged into wshobson/agents, a Claude Code plugin marketplace with 38,000 stars, then advertised it on Instagram. The skill carried no setup instructions of its own; it told the agent to read installation docs at stitch-design.ai, a domain AIR owns. After it was widely installed, AIR rewrote that page to tell agents to download and run a script. Cisco’s scanner, NVIDIA’s, and all three wired into skills.sh had already cleared the skill, because each of them reads the shipped files and none of them read the link. AIR’s headline figure of 26,000 compromised agents is unverified and it is selling a managed marketplace, so discount it; the mechanism is independently confirmed, and the skill is still merged.

Try this:

$ curl -sI https://stitch-design.ai/docs/sdk/ai-sdk
HTTP/2 302
location: https://stitch.withgoogle.com/docs/sdk/ai-sdk

Google’s real Stitch documentation, one redirect away. That URL sits near the bottom of a SKILL.md in wshobson/agents, a multi-harness plugin marketplace with 38,000 GitHub stars, under a heading that reads “Stitch Documentation”. It arrived in PR #509, opened 29 April and merged on 2 May, and it has been sitting there ever since.

The domain is not Google’s. It belongs to the security firm AIR, which published an account last week of what it did with that link.

Borrow the stars, then flip the switch

AIR’s researchers Niv Hoffman and Or Nevo wanted to test whether the signals people use to judge a skill mean anything. They picked a target audience of non-technical office workers, built a skill around Google’s newly launched Stitch design tool, and spent about an hour on it. The PR is a good piece of work: 266 lines of SKILL.md, a 218-line interview framework, a checked test plan. Nothing in it looks rushed.

For credibility they wanted GitHub stars, and rather than earn any they inherited someone else’s. Contributing a plugin to a popular marketplace repo means your skill is displayed with the repo’s star count attached. Three days after the PR opened, a maintainer merged it. Then came an Instagram ad aimed at marketers, salespeople and designers, and installs followed.

The trick is in what the skill omits. It contains no instructions for installing the Stitch SDK. It tells the agent to go read them at stitch-design.ai, which at that point faithfully redirected to Google. Seven weeks later, once the skill was in wide circulation, AIR replaced the page behind that link with a look-alike whose “installation” step was a script download. In the published version the script mailed the victim’s email address back to AIR and did nothing else, which is how the firm counted heads.

The switch was a config change on a Cloudflare-fronted domain. No new commit, no new release, no version bump anyone could diff.

The scanners were reading the wrong thing

AIR ran the skill past Cisco’s skill-scanner, NVIDIA’s skillspector, and every scanner wired into skills.sh. All of them passed it, and all of them were right about the files they read. The malicious content was on a web server.

Trail of Bits reached the same conclusion three weeks earlier by a harder route. In “The sorry state of skill distribution” (3 June), Samuel Judson and Tjaden Hess bypassed ClawHub’s detector, Cisco’s scanner and all three skills.sh integrations, and three of their four attacks took under an hour to build. One prepends 100,000 newlines so ClawHub’s harness truncates the file before reaching the payload. One hides a credential grab in a .pyc that differs from the .py beside it, which is the xz-utils pattern with new packaging. The most instructive one is a shell script that points npm at an attacker registry while explaining, in fluent corporate-onboarding prose, why that’s normal. Cisco’s scanner running Sonnet 4.6 spotted the registry, rated it LOW, worried in writing that the URL “could be hijacked”, and concluded the skill “presents a low security risk”.

Their verdict: “No amount of scanning or LLM analysis can reliably detect malicious content in agent skills.” A scanner is a static target, and an attacker gets unlimited attempts against it. That’s the attacker-moves-second result that broke twelve guardrail products last year, applied to a new category of product.

How much of this should you believe?

Less than the headline suggests. The 26,000 figure, the corporate-account detail and the claim of potential full control over every affected machine all come from AIR, none are independently confirmed, and the write-up ends by pitching AIR Marketplace. The Hacker News flagged exactly that in its coverage, which is more skepticism than vendor research usually gets from trade press.

What survives the discount is everything checkable. The PR is public. The scanners really do judge only the submitted package. And AIR’s follow-up on 24 June puts numbers on the scale of the primitive: 17,822 open-source skills with 6.7 million installations between them fetch instructions from external sources, roughly 12.4% of GitHub skills. Most of those skills are honest. Their authors wrote “read the docs here” and meant it. OWASP added untrusted external instruction sources to its Agentic Skills top-ten risks the same day.

What actually helps

Anthropic’s own skills documentation already warns that skills fetching external URLs can change after vetting. The warning is correct and nobody reads it, because the ecosystem replaced reading with a green checkmark.

Trail of Bits’ advice is the boring supply-chain answer and it is the right one: curate a marketplace your organisation controls, pin versions, control who can add or update, and don’t hand that judgment to a tool. Treat what a skill points at as part of the skill. An agent that fetches a URL and follows what it finds there is executing code from that URL, with whatever access you gave it.

On the Hacker News thread about January’s ClawHub malware wave, user OptionOfT put it as well as anyone: “So many years of work in Software and Hardware Engineering to separate instructions from data. NX bit, ASLR, prepared statements etc. All out the door.”

The skill is still merged. Its docs link still resolves to Google, for now.

Sources

Related on this blog

Previous Post
Three Ways to Type an Em Dash. The Machines Need None of Them.
Next Post
The Trap Fired in Seconds. The Humans Took 18 Days.