Trojan AI Skills Tricked Agents Into Stealing Secrets

Attackers uploaded fake “AI agent skills” that looked like legitimate integrations for popular agent tools. The skills quietly instructed agents (and the developers running them) to install a credential-stealing payload directly from attacker-controlled GitHub repos, leading to 1.7M+ downloads before discovery.

Key findings

• Malicious skills were uploaded to skills.sh (an agent-skill marketplace) using typosquatted names mimicking Paperclip and Browser Use.
• The campaign relied on a “bait and switch”: initially uploading legitimate-looking skills, then updating them with malicious installation instructions on July 11.
• After npm and PyPI removed the attackers’ trojan packages, the skills were updated to instruct installation directly from attacker-controlled GitHub repositories.
• The credential-stealer targeted high-value secrets on developer machines, CI runners, and agent workspaces (SSH keys, cloud creds, tokens, Kubernetes/Docker configs, and .env files).
• The attack hid the malicious step using “progressive discovery,” placing the dangerous command in a secondary setup file the agent would only open during installation.

Who’s being targeted

• Commonly targeted roles: Software Engineers, DevOps / Platform Engineering, Security Engineering (AppSec/CloudSec), IT administrators supporting developer endpoints, Teams adopting AI agents/agentic workflows.
• Affected industries: Software development, DevOps/CI-CD operations, Cloud-hosted technology services.
• Attack channels: website, github.
• Impersonated: A legitimate Paperclip AI skill/integration author (typosquatted).

Awareness takeaways

• Treat AI agent “skills” and configuration files as software supply chain inputs: require review/approval before use or updates.
• Be suspicious of setup instructions that force installation from an unusual source (random GitHub repo/release) and explicitly tell you not to use standard package managers.
• Don’t assume a “trending” marketplace listing is safe, attackers can game discovery systems with typosquatting and later updates.
• Protect developer workstations and CI runners as high-value targets; monitor for credential access patterns and unexpected secret collection.

Red flags to watch for

• Instructions insist on avoiding the normal/expected install method (e.g., “do not use npx …”)
• Installation is redirected to a GitHub repo/release as the “only source of authority” instead of official registries
• Skill looks legitimate at first but hides critical steps in a secondary setup document