Poisoned AI skills turn marketplace trust into credential theft

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Cyera's research: Poisoned AI skills were used to distribute Atomic macOS Stealer, and marketplace security grades failed to flag the malicious instruction chain.

Why it matters: AI skills are becoming a delivery surface for developer credential theft, so security teams need controls that inspect instructions, dependencies, and execution behavior rather than relying on marketplace trust signals.

By the numbers:

• Cyera tracked 516 skills tied to the Atomic macOS Stealer campaign.
• Of the 70 confirmed malicious skills in September 2026, every one carried an A or B security grade on a popular marketplace.
• Cyera reported that developer tools were the most commonly targeted category at roughly 36%.

Context

Poisoned AI skills are a supply chain problem for identity security because the harmful behavior is hidden in trusted-looking instructions, not only in executable files. When an agent follows a skill’s setup steps, the control gap is no longer just malware scanning, it is whether the organisation governs what the skill is allowed to request, download, and run.

In practice, the risk sits at the intersection of secrets exposure, delegated execution, and user trust. A malicious skill can look ordinary, inherit credibility from a marketplace grade, and still steer a developer or agent toward code that installs stealer malware.

That makes skills governance part of the broader NHI problem space: the identity is not the marketplace listing, but the runtime path that the skill creates for credentials and tool use.

Key questions

Q: What makes an AI skill dangerous even when it looks legitimate?

A: An AI skill is dangerous when its instructions, tool calls, or hidden prompts can redirect an apparently legitimate task into unauthorised data access, message sending, or code execution. Instruction review should cover the full runtime scope, including tool permissions, external calls, and any embedded links or files that can override the intended behaviour.

Q: Why do marketplace security ratings miss malicious AI skills?

A: Marketplace security ratings often judge the listing, publisher, or static package metadata, not the skill’s full execution path, so they miss malicious behaviour that appears only after runtime prompts, tool chaining, or external content retrieval. A rating can therefore look clean while the deployed skill still reaches sensitive data or executes unsafe actions.

Q: How does Atomic macOS Stealer get delivered through poisoned skills?

A: Atomic macOS Stealer is delivered through poisoned skills when setup instructions push the target toward a remote payload, encoded command, or fake utility that installs the stealer. The malware then captures browser passwords, cookies, keychain data, and other sensitive files. This delivery method works because the malicious step is embedded in a task the user or agent expects to perform.

Q: What should teams do first when a skill requests a download or shell command?

A: Teams should stop the request and inspect the download target, command syntax, and allowed execution context before permitting any fetch-and-run behaviour. Treat the skill as untrusted until the file source, checksum or signature, and shell privileges are verified, because a legitimate-looking prompt can still stage a payload or change system state.

Technical breakdown

How poisoned skills turn documentation into an execution path

A poisoned skill uses ordinary markdown or instructions as the delivery mechanism for malicious behavior. Instead of dropping an obvious binary first, the attacker hides prerequisites, setup steps, or troubleshooting guidance that leads a user or agent to fetch remote content, decode a payload, or run a command. The content looks like documentation, but the actual effect is a staged install chain. This works because many inspection systems focus on code or binaries and treat text as low risk, even though the text is what triggers execution. In AI workflows, that means the instruction layer becomes part of the attack surface, not just the model or the endpoint. See the AI Coding Agents Security Guide.

Practical implication: Inspect skill instructions as executable-risk material and block external fetch-and-run patterns before they reach runtime.

Why marketplace grades can miss malicious skill behavior

Marketplace trust signals often evaluate the visible skill file, not the full behavior chain the file initiates. If a scoring system only reviews one document, or only checks the skill after upload, it can award a clean grade to content that still contains hidden installation logic. That creates a false assurance problem: the rating describes the surface artifact, while the attacker abuses the runtime outcome. Cyera’s findings show that grade-based trust is weak when the malicious block sits in the middle of otherwise useful content or when the harmful payload is external to the reviewed file.

Practical implication: Treat security grades as one input, not a clearance decision, and validate the full dependency and execution path.

What AMOS theft looks like inside a skill-driven attack chain

Atomic macOS Stealer is an infostealer that targets Macs and collects browser passwords, session cookies, keychain data, and other sensitive files. In a poisoned skill chain, the skill’s instructions pull the victim toward a fake prerequisite or utility, then deliver the payload through a pasted command, encoded script, or relay link. The result is credential theft, not just malware installation. The important point for defenders is that the lure is operationally plausible: the malicious instructions are embedded in a task the user or agent already expects to perform, which lowers suspicion and increases execution success. See the Atomic macOS Stealer Guide.

Practical implication: Focus detections on install behavior, encoded commands, and unexpected prerequisite downloads tied to skill usage.

Threat narrative

Attacker objective: The attacker’s objective is to steal developer credentials and session material that can be reused for account takeover, lateral movement, or further malware delivery.

1. Entry begins when a user or agent loads a seemingly useful skill that contains malicious prerequisite instructions inside normal documentation.
2. Credential theft follows when the skill directs the target to download or execute a staged payload such as AMOS through encoded or relayed commands.
3. Impact lands when the stealer harvests browser passwords, cookies, keychain data, or sensitive files and sends them to attacker-controlled infrastructure.

Breaches seen in the wild

• ClawHub malicious skills 2026: Hundreds of malicious ClawHub skills for the OpenClaw agent pushed credential stealers in early 2026; Koi found 341 of 2,857 in the ClawHavoc campaign.
• Secrets in VS Code extensions 2025: Wiz found 550+ secrets in VS Code extensions, including publishing tokens able to push malicious updates to about 150,000 installs.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Marketplace trust is not a governance control. Cyera shows that a high security grade on a skills marketplace did not prevent malicious AMOS-delivering skills from circulating. That means the real control question is not whether a listing looks reputable, but whether the organisation governs what a skill can cause an agent or user to execute. Practitioners should treat trust signals as advisory, not authoritative.

Instruction-level abuse is now a credential risk, not just a malware risk. Poisoned skills convert documentation into a credential theft path by steering users toward commands that install stealer payloads. The dangerous part is the runtime instruction chain, not the file type alone. Security programmes that only scan binaries or source code miss the stage where the attack actually begins.

Skills marketplaces are creating an over-trust problem for AI workflows. A security grade can imply safety while the skill still contains a hidden fetch-and-run chain, which is a false assumption in agentic environments. Users and agents tend to treat marketplace presence as validation, but the attacker only needs one plausible prerequisite block to bypass that confidence. The implication is that governance has to move from reputation to behavior.

Secret exposure through skills is a named control gap, not an edge case. Instruction trust debt: marketplace review models were designed for static artifacts, not for skills that embed malicious dependencies in natural-language setup steps. That assumption fails when an agent can follow instructions as if they were policy, because the malicious action is created at execution time. The implication is that review cadences must be replaced by runtime scrutiny of what the skill is allowed to trigger.

Developer-focused skills are the most consequential target because they sit closest to secrets. Cyera’s category analysis shows developer tools were the largest target segment, which makes sense because those workflows already touch credentials, tokens, and build paths. A poisoned skill aimed at developers can reach high-value secrets quickly, before conventional endpoint and malware controls understand the context. Practitioners should treat dev-facing skills as privileged delivery surfaces.

From our research library:

• Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to the State of Secrets in AppSec.
• Read next: AI Coding Agents Security Guide

What this signals

Instruction trust debt: skills governance built on marketplace reputation assumes the dangerous part of the attack is visible in the uploaded artifact. Poisoned skills break that assumption by hiding the harmful step in setup language, so the next control boundary has to be execution time, not publication time.

This pattern pushes practitioners toward stricter review of any skill that can request downloads, decode commands, or reach secrets. The number of malicious samples will matter less than the repeatable behaviors they share, because those behaviors can be hunted and blocked across many different skill topics.

Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to the State of Secrets in AppSec. That gap makes developer-facing skills an especially attractive route for credential theft because weak handling of secrets amplifies the damage of a poisoned instruction chain.

For practitioners

• Inspect skill instructions before execution Review SKILL.md and related companion files for prerequisite blocks, encoded commands, external relays, and language that forces downloads or shell execution.
• Block fetch-and-run dependency chains Prevent skills from launching external installers, paste-site relays, or Base64-decoded Bash commands unless they have been explicitly approved for the environment.
• Correlate skill use with credential activity Watch for token use, browser credential access, keychain reads, and unusual archive or executable downloads immediately after skill activation. See the API Key Management Guide.
• Revalidate marketplace trust signals Treat marketplace grades as a starting point and require independent review for skills that can install software, invoke shells, or access secrets.

Key takeaways

• Poisoned AI skills are dangerous because they move the attack from a visible payload to a hidden instruction chain that an agent or user may follow without suspicion.
• Cyera’s findings show that marketplace grades did not stop AMOS-delivering skills from being rated as trusted, which is a direct warning about reputation-based screening.
• The practical control shift is from static review of uploaded artifacts to runtime inspection of what a skill asks an environment or agent to do.

Related NHI Mgmt Group resources: AI Coding Agents Security Guide · API Key Management Guide · Secrets Management Guide · Ultimate Guide to NHIs: Static vs Dynamic Secrets

Key terms

• Credential Theft: Credential theft is the unauthorized capture of secrets used to authenticate a user or workload, such as passwords, MFA codes, or security questions. In SaaS environments, it usually produces login events that defenders can inspect, but it still becomes dangerous when attackers combine it with token abuse or integration misuse.
• Atomic MacOS Stealer: Atomic MacOS Stealer is an infostealer family that targets Apple endpoints and steals browser passwords, session cookies, keychain material, and other sensitive files. It is commonly distributed through deceptive installers and lure-based delivery chains that aim to convert user trust into credential theft.
• Fetch-and-Run Pattern: The Fetch-and-Run Pattern is a technique where a script or command downloads content from a remote source and immediately executes it. It is commonly used for software installation and automation, but it also creates a narrow trust window because the fetched payload can change after review or be swapped for malicious code.
• Skill Marketplace: A distribution layer where third-party extensions add capabilities to an AI agent or assistant. The security issue is not just the code itself, but the access it requests, the data it can read, and the way it can steer privileged actions through the host runtime.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.