Fake AI Agent Skill Exploits Security Gaps, Reaches 26,000 Users

A recent investigation by AIR revealed how a counterfeit AI agent skill successfully passed security evaluations and reached over 26,000 users via Instagram. The skill, posing as a tool to assist with Google’s Stitch design tool, was integrated into a popular agents repository and promoted through social media ads. AIR's experiment highlighted significant vulnerabilities in the way AI-driven tools are vetted, emphasizing the need for continuous scrutiny beyond initial approval.

The so-called "brand-landingpage" skill appeared credible by leveraging trust signals such as GitHub reputation and security scanner verdicts. Submitted to a repository boasting approximately 36,000 GitHub stars, the skill was quickly merged, allowing AIR to promote it through Instagram ads. Users were directed to install the skill, which instructed agents to set up a Stitch SDK via a domain controlled by AIR, rather than Google’s genuine site.

The malicious capability didn’t rely on suspicious code within the skill itself. Instead, AIR redirected the domain to Google's real website, making detection difficult. AIR's test demonstrated that the skill could pass all major security scanners at Cisco, Nvidia, and skills.sh.

Once distributed, AIR altered the content behind the fake Stitch documentation, leading agents to download and execute a script. Although the script only collected email addresses for notification purposes, the same method could potentially compromise systems using the agent.

The experiment underscores the inadequacy of current skill security scanners, which focus on static reviews of packages. It suggests that AI skills should be viewed as part of the enterprise software supply chain, requiring rigorous oversight akin to third-party open-source packages or SaaS integrations.

Security experts like Devashri Datta and Keith Prabhu stress the necessity for continuous validation and strict runtime controls. Enterprises should maintain detailed inventories of AI skills, validate external URLs, and restrict network calls to approved domains. The dynamic nature of AI skills demands that they be treated as "living third-party dependencies," with lifecycle assessments to prevent post-deployment behavioral changes.

Datta also recommended that enterprises implement version pinning and immutable reference tracking for any skill fetching external instructions. This approach ensures that content remains secure and manageable within an enterprise-controlled environment, reinforcing the security posture against evolving threats.