Agent-to-agent skill marketplaces are becoming a supply chain risk

At a glance

What this is: Straiker describes an active agent-to-agent attack chain in which malicious AI skills are distributed through ClawHub and used for scams, key theft, and persona-driven propagation.

Why it matters: IAM, NHI, and agentic AI teams need to treat skill marketplaces as governed identity surfaces because autonomous tool use can expand blast radius faster than manual review cycles can contain it.

👉 Read Straiker’s analysis of the ClawHub agent-to-agent attack chain

Context

Claude Skills turn a language model into an action-capable system by letting it call tools, reach external services, and execute workflows. That makes the identity question bigger than prompt safety: the relevant control plane is now the permissions, provenance, and execution boundary around the skill itself, not just the model output.

Straiker’s findings show what happens when an agent-facing marketplace scales faster than governance. When malicious skills can be published, copied, and promoted through fake personas, the issue becomes an identity supply chain problem across AI agents, credentials, and downstream systems. This is an agentic AI risk pattern, not a traditional software bug report.

For security teams, the starting assumption should be that any community skill can become an untrusted identity bridge. The article’s subject is atypical only in its packaging; the underlying pattern is familiar to anyone who has watched secret exposure, unreviewed tooling, and delegated access combine into operational risk.

Key questions

Q: How should security teams govern AI-enabled workflows that can act on their own?

A: Treat them as identity-governed execution paths, not just software features. Assign a named owner, define least-privilege access, log every tool call, and require revocation paths for credentials and tokens. If the workflow can touch production systems or sensitive data, its permissions must be reviewed with the same discipline used for privileged machine identities.

Q: Why do AI coding agents increase supply-chain risk?

A: AI coding agents can choose tooling, install packages, and edit lock files in ways that may bypass the controls humans expect in a managed environment. That widens the blind spot around untracked software and makes package provenance harder to enforce. The practical response is to restrict agent permissions, inventory their workspaces, and review their install behaviour like any other privileged automation.

Q: What breaks when a malicious skill inherits an agent’s permissions?

A: What breaks is the assumption that authorised execution is also safe execution. Once a skill inherits the agent’s permissions, it can use whatever the surrounding workflow already allows, including data access, tool calls, or financial actions. That creates a gap between declared purpose and actual power.

Q: How can organisations reduce blast radius when an AI tool is compromised?

A: Limit the tool's scope, separate high-risk functions from general collaboration data, and make revocation fast enough to matter. Pair least privilege with short-lived tokens, clear ownership, and logging that links the agent, the user, and the downstream system. Containment only works when those paths are visible.

Technical breakdown

Why AI skill marketplaces become an identity supply chain

An AI skill marketplace is not just a catalog of plugins. It is a distribution layer for executable instructions, permissions, and external dependencies that an AI system can invoke at runtime. When skill definitions include code, remote fetches, or embedded tool instructions, the marketplace becomes part of the trust chain for every downstream action. That means provenance, permission scope, and update integrity matter as much as the skill’s stated purpose. The security failure is not only malicious code. It is the assumption that published equals safe enough to execute.

Practical implication: review skill provenance, permission scope, and external dependencies before any deployment into production workflows.

Agent-to-agent propagation changes how social engineering works

The article’s core twist is that deception is no longer aimed only at humans. Fake AI personas can recommend, amplify, and legitimise malicious skills inside agent ecosystems, creating an emergent trust layer between systems that were never meant to self-certify one another. In practical terms, this is social engineering with algorithmic intermediaries. The attacker is not relying solely on a user click. They are using one agent’s perceived credibility to influence another agent’s distribution path and execution behaviour.

Practical implication: monitor agent recommendations and marketplace promotion channels as part of identity threat detection, not just human communication channels.

Why autonomous execution increases the blast radius of compromised skills

When a skill is invoked inside an agentic workflow, the skill can act with the privileges and timing of the system that called it. That shifts risk from static code review to runtime governance. A malicious skill can manipulate transactions, exfiltrate keys, or redirect payments without needing a separate human approval step if the surrounding workflow already authorises execution. The decisive issue is not whether the model can reason. It is whether the execution boundary is tight enough to prevent delegated action from becoming delegated abuse.

Practical implication: bind skills to least-privilege, short-lived credentials and isolate them in monitored execution environments before production use.

Threat narrative

Attacker objective: The attacker aims to monetise trust in AI skill ecosystems by stealing credentials, redirecting funds, and scaling malicious distribution through agent-to-agent credibility.

1. Entry occurs through publication of deceptive AI skills on a community marketplace and through fake personas that boost credibility and spread those skills across agent communities.
2. Escalation follows when a deployed skill inherits the caller’s permissions, allowing it to manipulate transactions, access sensitive material, or reach connected tools without additional human review.
3. Impact includes crypto theft, private key exposure, redirected payments, and broader supply chain poisoning as compromised skills propagate through trust relationships between agents.

Breaches seen in the wild

• Meta AI Instagram Account Takeover — 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.
• Replit AI Tool Database Deletion — Replit vibe coding AI assistant deletes live production database and creates 4,000 fake user records.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

AI skill marketplaces are becoming identity distribution systems, not just software stores. When a skill can carry instructions, external calls, and permission requests into an agentic workflow, the marketplace becomes part of the identity trust chain. That shifts governance from code inspection to provenance, scope, and execution control. Practitioners should treat skill distribution as a governed identity surface.

Agent-to-agent trust is a new form of delegated risk. The article shows that AI systems can become amplifiers of malicious content when one agent’s credibility influences another’s execution path. This is not classical phishing, but it reuses the same governance weakness: trust accepted without verification. Security teams need to account for machine-mediated social proof in their threat models.

Implicit permission is the named concept that matters here. Skills often inherit broad runtime access because the surrounding agent already has credentials, tool rights, or workflow authority. That assumption fails when the skill itself becomes the attacker’s payload. The implication is that security programmes must stop equating authorised execution with authorised intent.

Blast radius now depends on the intersection of marketplace hygiene and credential scope. A malicious skill with narrow access is an annoyance; the same skill with cloud, finance, or source-control permissions becomes a breach path. This is why agentic AI governance must be evaluated alongside NHI controls, not after them. Practitioners should measure how far a compromised skill can move before containment triggers.

The control gap is not the existence of skills, but the absence of enforceable boundaries around them. Static review alone cannot compensate for runtime fetching, opaque dependencies, or broad tool permissions. As these ecosystems scale, the winning organisations will be the ones that can prove where the execution boundary begins and ends. Identity teams should prioritise that boundary now.

From our research:

• 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%), according to AI Agents: The New Attack Surface report.
• From our research: 92% agree governing AI agents is critical to enterprise security, yet only 44% have implemented any policies to do so, according to AI Agents: The New Attack Surface report.
• For a broader control baseline, see OWASP Agentic AI Top 10 for the runtime risks that make delegated skill execution hard to secure.

What this signals

Implicit permission: the next governance failure will come from systems that inherit broad rights simply because they were invoked by a trusted agent. That pattern forces IAM and NHI teams to inspect execution context, not just identity state, because a skill can be safe in review and unsafe at runtime. The practical signal is to pair least privilege with monitored delegation boundaries.

As AI agents become more common inside business workflows, marketplace hygiene starts to look like a board-level identity issue. The article’s attack chain suggests that the control question is no longer whether a skill exists, but whether the organisation can explain what it can touch, how it is updated, and who can revoke it. That is why identity governance must extend into agent tooling, not stop at human accounts.

With 33% of organisations saying their AI agents have accessed inappropriate or sensitive data beyond intended scope, according to the AI Agents: The New Attack Surface report, the operational priority is containment, not curiosity. Teams should start from the assumption that any skill marketplace can become a distribution layer for delegated abuse.

For practitioners

• Audit skill provenance before deployment Require source review for every skill that can reach external services, fetch runtime content, or request credentials. Treat community-built skills like untrusted packages and block deployment until provenance is clear.
• Bind skills to scoped credentials Use short-lived, least-privilege credentials for agent workflows so a compromised skill cannot inherit broad access to cloud, finance, or code systems. Revoke any credential that is not explicitly tied to a business task.
• Isolate and monitor skill execution Run new skills in monitored environments first, with alerting for unexpected network calls, file access, token use, and data exfiltration attempts. Promote only after behaviour matches declared scope.
• Treat agent promotion channels as threat surfaces Monitor persona-driven distribution, recommendation loops, and marketplace amplification for coordinated campaigns. The relevant signal is not just malicious code, but the social pattern that causes agents to trust and install it.

Key takeaways

• AI skill marketplaces are now part of the identity attack surface because they can distribute executable trust, not just software.
• Agent-to-agent promotion creates a machine-mediated social engineering path that can spread malicious skills faster than human review cycles can catch them.
• Identity teams should reduce skill blast radius by narrowing credentials, isolating execution, and governing provenance before production use.

Key terms

• Agent-to-Agent Chain: A sequence of autonomous software entities handing work, context, or requests from one agent to another. Each hop can widen the trust boundary, weaken identity context, and create unreviewed access to systems or data if one link is unregistered or misconfigured.
• Skill Marketplace: A distribution layer where third-party extensions add capabilities to an AI agent or assistant. The security issue is not just the code itself, but the access it requests, the data it can read, and the way it can steer privileged actions through the host runtime.
• Implicit Permission: Access that is granted by surrounding workflow context rather than by an explicit, task-scoped approval. In agentic systems, this is dangerous because a skill may inherit broad rights from the caller and then use them in ways the operator never intended.
• Blast Radius: The potential scope of damage if a specific credential or identity is compromised. Identities with broad permissions have a larger blast radius and represent a higher priority for least-privilege enforcement and security controls.

What's in the full report

Straiker's full blog post covers the operational detail this post intentionally leaves for the source:

• Static analysis and dynamic testing methods used to audit public Claude Skills on ClawHub
• Specific malicious skill patterns, including crypto scams, credential theft, and deceptive persona campaigns
• The Bob P2P case study showing how the attack chain propagated across ClawHub, Moltbook, and token channels
• Recommended platform controls for mandatory review, permission scoping, signing, and transparency reporting

👉 Straiker’s full post covers the Bob P2P case study, malicious skill patterns, and marketplace control recommendations.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or programme maturity, it is worth exploring.