Topic starter
06/11/2026 6:56 pm
TL;DR: Malicious setup instructions in poisoned AI skills can deliver AMOS while still passing automated marketplace grading, according to Cyera analysis. Practitioners need to inspect what a skill instructs an agent to do, not just its reputation or topic.
Editorial analysis by NHI Mgmt Group, based on content published by Cyera: “Poisoned Skills Are Targeting Developer Credentials”.
By the numbers:
- Cyera tracked 516 skills tied to the Atomic macOS Stealer campaign.
- Of the 70 confirmed malicious skills in September 2026, every one carried an A or B security grade on a popular marketplace.
- Cyera reported that developer tools were the most commonly targeted category at roughly 36%.
Key questions
Q: Why do marketplace security ratings miss malicious AI skills?
A: Marketplace security ratings often judge the listing, publisher, or static package metadata, not the skill’s full execution path, so they miss malicious behaviour that appears only after runtime prompts, tool chaining, or external content retrieval.
Q: How does Atomic macOS Stealer get delivered through poisoned skills?
A: Atomic macOS Stealer is delivered through poisoned skills when setup instructions push the target toward a remote payload, encoded command, or fake utility that installs the stealer.
Q: What makes an AI skill dangerous even when it looks legitimate?
A: An AI skill is dangerous when its instructions, tool calls, or hidden prompts can redirect an apparently legitimate task into unauthorised data access, message sending, or code execution.
Practitioner guidance
- Inspect skill instructions before execution Review SKILL.md and related companion files for prerequisite blocks, encoded commands, external relays, and language that forces downloads or shell execution.
- Block fetch-and-run dependency chains Prevent skills from launching external installers, paste-site relays, or Base64-decoded Bash commands unless they have been explicitly approved for the environment.
- Correlate skill use with credential activity Watch for token use, browser credential access, keychain reads, and unusual archive or executable downloads immediately after skill activation.
Bottom line: Poisoned AI skills are dangerous because they move the attack from a visible payload to a hidden instruction chain that an agent or user may follow without suspicion.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:56 pm
Marketplace trust is not a governance control. Cyera shows that a high security grade on a skills marketplace did not prevent malicious AMOS-delivering skills from circulating. That means the real control question is not whether a listing looks reputable, but whether the organisation governs what a skill can cause an agent or user to execute. Practitioners should treat trust signals as advisory, not authoritative.
A few things that frame the scale:
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to the State of Secrets in AppSec.
A question worth separating out:
Q: What should teams do first when a skill requests a download or shell command?
A: Teams should stop the request and inspect the download target, command syntax, and allowed execution context before permitting any fetch-and-run behaviour. Treat the skill as untrusted until the file source, checksum or signature, and shell privileges are verified, because a legitimate-looking prompt can still stage a payload or change system state.
👉 Read our full editorial: Poisoned AI skills turn marketplace trust into credential theft