Malicious AI skills on skills.sh stole secrets after building trust: why it is not safe to use

What happened

TechRadar reported on August 7, 2026 that Zenity Labs found a credential-stealing campaign on skills.sh, a public registry for AI agent skills owned by Vercel. According to the report, attackers copied legitimate skills and used typosquatted names, which are lookalike names meant to confuse people. The skills appeared harmless at first, then were later updated with code that told agents to send out sensitive files and keys.

The reported targets included SSH keys, cloud credentials, Git and package-manager tokens, Kubernetes and Docker config files, database credentials, infrastructure-as-code credentials, environment files, and service-account files. Zenity said one malicious skill family reached more than 1.7 million aggregate installs. Researchers also reported dozens of other malicious or dangerous skills. The same coverage says about 30% of the dangerous skills they identified used Claude Code and OpenClaw to install malware, which is harmful software.

What it means for you

If you use an AI agent, a skill can look useful and still become risky later through updates. The main risk here is loss of secrets stored on your machine or in project folders.

What to do instead

Install skills carefully, especially if a name looks similar to a well-known one. Review what a skill can access, keep sensitive keys out of everyday work folders when possible, and rotate tokens or keys if you think one was exposed. Prefer reviewed sources. AgentPod lists only reviewed, tested skills, which can reduce risk, but it is still smart to check what any skill does before using it.

Sources:

• https://www.techradar.com/pro/security/experts-warn-malicious-ai-skills-are-hitting-more-victims-than-ever-with-one-family-amassing-1-7-million-downloads