A simulated attack involving a deceptive AI agent skill demonstrated how security measures can fall short, affecting over 26,000 users through a targeted Instagram ad. The incident emanated from a malicious skill called brand-landingpage, framed as a tool for creating landing pages using Google's Stitch design tool, which aimed to entice non-technical users, particularly marketers and designers.
According to AIR, the firm behind the experiment, some malicious agents were associated with corporate accounts, potentially endangering confidential information and internal systems. Importantly, no actual harm occurred to any agents involved, as the experiment strictly collected users' email addresses for notification purposes.
To bolster the skill's credibility, AIR focused on acquiring two essential trust signals: a reputable GitHub presence and positive assessments from security scanners. Instead of building the credibility from the ground up, it submitted the skill to an open-source repository boasting about 36,000 GitHub stars. Within days, the pull request gained approval, setting the stage for the skill's dissemination.
Promotion was executed through targeted Instagram advertising, prompting users to download and engage with the skill. What stands out about this technique is that it didn't rely on inserting malicious code directly within the skill files. Instead, the compromised skill directed agents to install a Stitch SDK through instructions hosted on a misleading domain, stitch-design.ai, which AIR controlled. This domain cleverly redirected users to the legitimate Stitch site, making it challenging to identify the threat through static analysis alone.
“Current security scanners primarily rely on analyzing static resources and bundled files, which can lead to misleading assessments of skill safety,” AIR stated. The malicious skill passed evaluations from security scanners including those from Cisco, Nvidia, and skills.sh, all deeming it safe.
After widespread distribution, the researchers modified the content behind the fake Stitch documentation. The updates instructed users to download and execute a script, which in the trial collected email addresses but could just as easily have been designed to compromise users’ machines. This highlights a critical insight: AI skills' security cannot hinge solely on initial scanning of packaged files, as their behavior can change post-approval.
AI Skills as Dependencies
The implications for security teams extend beyond mere initial assessments; the evolving behavior of skills post-installation raises significant concerns. As noted by cybersecurity expert Devashri Datta, organizations might need to reconceptualize AI skills as integral components of their software supply chain rather than just static prompts or scripts.
“Considering agent skills as simple text is a fundamental misunderstanding of their operational roles,” Datta remarked. “They represent executable instructions that dictate how agents function, interact with enterprise systems, and route data. Thus, they need to be managed as rigorously as third-party applications or SaaS integrations.”
Keith Prabhu, CEO of Confidis, echoed this sentiment, emphasizing that AI agent skills must be regarded as dynamic dependencies subject to continuous evaluation rather than static plugins. “A single security scan won’t cut it anymore; there needs to be ongoing validation and stringent runtime controls,” he stated.
This strategy begins with establishing an inventory of AI skills at the enterprise level, which provides security teams with clear ownership and visibility into the skills’ external interconnections and data flow permissions. This case underscores the inadequacy of static point-in-time scanning approaches, especially in environments dependent on machine-learning orchestrated processes. The skill succeeded in passing security checks because its threatening payload resided behind a mutable URL that changed after the initial distribution.
The Necessity of Runtime Checks
To mitigate risks, enterprises should implement version pinning and immutable reference tracking for any skill that fetches external resources or instructions. This external content should be constrained to a controlled, enterprise-hosted environment and tied to cryptographic hashes.
Enforcement of the principle of least privilege at the agent level is also paramount; skills should not inherit the full access rights of the user who activates them. Prabhu further advised that assessments of AI agent skills should encompass their entire lifecycle, not just their initial installation. Organizations should restrict employee access to verified markets and pre-approved skills, vet external URLs tied to those skills, and thoroughly test them in a sandbox prior to full deployment.
At runtime, restrictions on network calls to specified approved domains, coupled with monitoring for unusual activity, can serve as essential safeguards. This proactive layer is critical, as skills that appear trustworthy during installation might exhibit changed behaviors that pose risks once they've been granted trust.
