TL;DR: A fake copy of Anthropic’s PDF skill preserved the familiar name and helper scripts while replacing core instructions and adding a Linux backdoor, turning a routine document task into a path for remote command execution and broader exposure, according to Cyera. Trust in agent inputs must move from brand recognition to package-level verification.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Cyera's research: A fake copy of Anthropic's PDF skill hid rewritten instructions and a Linux backdoor, showing that trusted agent packages can conceal malicious behaviour.
Why it matters: Identity and access teams need to treat AI agent skills like governed components, because package trust now depends on file contents, not just source names or descriptions.
Context
AI agent skills are packaged instructions and supporting files that tell an agent how to complete a task. When those packages are copied or updated outside a controlled source, the name on the package can stop matching the behaviour inside it.
The governance gap is not just software integrity. It is delegated trust: the agent executes what it reads, so a tampered skill can redirect action, network calls, and file execution without any change to the outward label.
For practitioners, the problem sits at the intersection of NHI governance and software supply chain control. A skill that looks legitimate can still be the wrong thing to let an agent load, especially when it can reach data, tools, or execution environments.
Key questions
Q: How do AI skill packages change the trust model for agents?
A: AI skill packages change the trust model by combining instructions, scripts, and supporting files into one consumable unit. If any part of that unit is altered, the agent may follow malicious task logic while the package still appears legitimate. Governance therefore has to cover the complete package, not just the publisher name or the visible scripts.
Q: What should teams check before an agent loads a third-party skill?
A: Teams should check the skill’s source, signed provenance, requested tool scopes, data access, and any transitive code or dependency loading before an agent installs it. A full archive helps verify what was actually shipped, not just the published manifest. The human owner must approve runtime authority, especially if the skill can read secrets, call tools, or persist state.
Q: Why do malicious instructions matter more than file names in AI agents?
A: Malicious instructions matter more because an agent follows the instruction layer at runtime, so a trusted file name can still conceal hostile prompts or tool commands. Defences must inspect the content the model reads, enforce allowlisted tools and scoped credentials, and separate untrusted text from control instructions. A safe label does not protect against injected commands.
Q: How can teams reduce the impact of a malicious AI skill?
A: They should limit the permissions an agent can lend to any skill, require sandbox detonation before production use, and keep a record of prior analyses so untrusted skills do not repeatedly reach approval decisions. The goal is to shrink inherited privilege before runtime behaviour can be abused.
Technical breakdown
How malicious skill packages alter agent behaviour
AI skills bundle instructions, scripts, and reference material into one component that an agent can load and follow. If the instruction file is changed while the name and helper files stay familiar, the agent may still treat the package as trusted and execute altered task logic. That is different from ordinary malware dropped into a system, because the malicious behaviour is embedded in the task instructions themselves. In this case, the instruction file was drastically shortened and redirected the agent toward external network activity, while the package still carried the expected supporting files. See the AI Agent Identity Security Buyer's Guide.
Practical implication: Validate the full package contents, not just the visible name or scripts, before allowing an agent to use a skill.
Why instruction tampering is an identity problem
Agent identity governance is about what an agent is authorised to do with the component it consumes. When the component itself contains untrusted instructions, the trust boundary shifts from the binary or archive to the instruction layer. That means a package can be source-verified at the file level yet still change the agent's intended action path, tool use, or network behaviour. In practice, this creates an identity and authority problem because the agent is still acting within its granted permissions, but on the basis of falsified task intent. See the AI Agent Authorisation Guide.
Practical implication: Treat skill instructions as part of the governed identity surface and review them with the same care as executable code.
How backdoors inside skills change the blast radius
A hidden executable inside a skill package can transform a simple document task into remote shell access if the agent or host runs it. That turns a narrow workflow into a broader compromise path, especially when the agent operates on a workstation, server, or document repository with real credentials and data access. The key issue is not only whether the executable is present, but whether the package creates a plausible chain from task execution to remote control. A skill can therefore remain apparently useful while quietly expanding the impact of misuse. See the AI Agent Observability, Audit and Incident Response Guide.
Practical implication: Constrain agent permissions so that loading a skill does not automatically grant network reach or software execution rights.
Threat narrative
Attacker objective: Use a trusted-looking AI skill to gain remote command execution and broader access through the permissions of the launching account.
- Entry via a copied skill archive that appeared to be a legitimate PDF-processing package but contained altered instructions.
- Credential access and execution risk emerged when the package instructed the agent to make external network calls and bundled a Linux executable capable of handing remote control to an operator.
- Impact would come from the agent running the package with the permissions of the account that launched it, exposing systems, credentials, and sensitive files.
Breaches seen in the wild
- CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
- AI agent retail card theft campaign 2026: AI agents breached 27+ retailers for about $25 each, used cloud keys and a Secrets Manager dump, and stole 600,000+ payment cards.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Complete-package trust is the real control boundary: A skill's name and known helper files are not sufficient evidence of safety when the instruction layer can be replaced. Cyera's finding shows that agent trust has moved from visible branding to the exact archive, file set, and task logic the agent will actually consume. Practitioners should treat the package itself as the governed object, not the label attached to it.
Instruction tampering is a delegated-authority failure: AI agents do not merely execute files, they execute instructions with the permissions they were given. That means a malicious skill can change what the agent believes it should do without changing the user's request, which makes the trust gap fundamentally about authority transfer. The right governance question is who can alter the instruction set the agent will obey, not just who can upload a file.
Runtime safeguards cannot compensate for a poisoned package: Traditional scanning that focuses on known scripts or binary signatures will miss the part that matters most here, which is the rewritten instruction flow. The package can still preserve legitimate functionality while quietly adding a different objective and a remote access path. Package-level provenance: this is the named failure mode, and it should be the unit of review whenever agents load third-party skills.
Agent permissions become the amplification layer: The more network access, file access, and execution authority an agent has at task time, the more valuable any tampered skill becomes to an attacker. This is why least privilege must apply not only to the agent, but to the component it is allowed to consume. Practitioners should assume the package is an active control point, not a passive input.
Trust in familiar components is now a supply chain problem: Copied archives, mirrored repositories, and updated packages can all preserve the outward shape of a component while changing its behaviour. That creates a governance problem that spans source verification, update review, and approval of the specific file set in use. The implication for identity teams is simple: provenance checks must extend to agent-consumed instructions, not stop at the vendor name.
From our research library:
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
- Read next: AI Agent Authorisation Guide
What this signals
Package-level provenance is becoming a control point for agent governance: Agents do not need a compromised platform to go wrong if the skill they consume has been altered. That shifts governance toward verifying the exact instruction set, helper files, and executables the agent will consume before the task starts.
If an organisation cannot attest to what was inside the skill at load time, it cannot claim meaningful control over what the agent was authorised to do. That makes source verification and artefact inspection part of identity governance, not just software hygiene.
For practitioners
- Verify the full skill package before approval Compare every file in the archive against the claimed source, including instruction files, scripts, and any bundled binaries. Treat matching names or descriptions as insufficient evidence of trust.
- Inspect instruction files as governed artefacts Review task instructions for unexpected destinations, altered intent, or language that expands what the agent should do beyond the approved workflow.
- Restrict network and execution authority for agent tasks Limit the permissions available while a skill runs so a document-processing workflow cannot also reach arbitrary domains or launch software.
- Quarantine unfamiliar executables inside skills Block or sandbox any binary or script that is not expected for the task, and require explicit review before it can run in an agent context.
- Assign ownership for third-party skills used in sensitive workflows Name the team responsible for source verification, update review, and revocation when a skill changes or no longer matches its approved behaviour.
Key takeaways
- A trusted-looking AI skill can still carry altered instructions and a backdoor, so the real trust boundary is the complete package.
- The evidence points to package-level tampering as a practical attack path for agents, not just a theoretical supply chain concern.
- Practitioners need provenance checks, instruction review, and tight execution permissions before agent-loaded skills are allowed to run.
Related NHI Mgmt Group resources: AI Agent Authorisation Guide · AI Agent Identity Security Buyer's Guide · AI Agent Observability, Audit and Incident Response Guide · Agentic AI Identity Guide
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, OWASP Non-Human Identity Top 10 and MITRE ATT&CK define the specific risk controls and attack patterns relevant to this term.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI04 — Agentic Supply Chain Vulnerabilities | The altered skill package is a supply chain compromise of agent inputs and instructions. |
| ASI03 — Identity & Privilege Abuse | The skill changes what the agent is authorised to do with its existing permissions. | |
| Recommendation — Inspect agent-facing packages for tampering, provenance gaps, and unexpected payloads before execution. Constrain agent authority so a poisoned skill cannot expand action scope beyond the approved task. | ||
| OWASP Non-Human Identity Top 10 | NHI-03 — Vulnerable Third-Party NHI | A third-party skill archive behaves like an external identity-bearing component that can be compromised. |
| NHI-10 — Human Use of NHI | Users trusted the package by name and description, then let the agent act on it. | |
| Recommendation — Verify third-party components before trust is extended to them inside agent workflows. Separate human approval of a package name from machine trust in the files it contains. | ||
| MITRE ATT&CK | TA0006;TA0011 — Credential Access; Command and Control | The backdoor creates a path to remote control and possible credential exposure. |
| Recommendation — Map suspicious skill behaviour to credential access and command-and-control detection logic. | ||
Key terms
- AI Skill: A reusable bundle of prompts, scripts, references, and assets that an AI client can load when needed. In enterprise use, a skill becomes part of the workflow control surface because it can shape how the system responds, escalates, or handles policy-sensitive tasks.
- Instruction Tampering: Instruction tampering is the alteration of prompts, system instructions, or other control text so an AI system follows attacker-chosen directions. It can happen in files, messages, web content, or tool output, and it undermines trust because the model may treat modified instructions as authoritative.
- Agentic Supply Chain Vulnerability: An agentic supply chain vulnerability is a weakness that appears when AI agents depend on other agents, tools, prompts, models, data sources, or automation steps to complete work. It arises when trust, identity, permissions, or input integrity fails anywhere in that chain, allowing manipulation, misuse, or unintended actions across connected systems.
- Command-and-control: Command-and-control is the communication channel an attacker uses to issue instructions to malware and receive results back from a compromised host. For XWorm, the channel is encrypted and used for session management, payload delivery, surveillance, and modular expansion of capabilities after compromise.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on November 6, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org