# BONUS EPISODE: 76 Malicious AI Skills Were Hiding in Plain Sight

## Executive summary

The security landscape for AI coding agents is rapidly evolving, shifting focus from traditional code vulnerabilities to risks introduced by 'Skills' and context management. The presentation details findings from Snyk’s ToxicSkills research, which uncovered 76 malicious skills containing malware or prompt injection vectors in open agent repositories. To mitigate these threats, organizations must adopt secure-by-default practices, implement governance through private skill registries (like Tessl), and utilize advanced scanning tools that analyze natural language context alongside code.

## Key takeaways

- The Shift to Agent Security: AI agents are changing developer workflows from reviewing lines of code to managing a 'team of agents.' This necessitates securing the inputs (context) and artifacts produced by these agents, making agent security paramount.
- Malicious Skills Threat: Research found that third-party skills can contain purely malicious code or prompt injection attacks. These threats are difficult for traditional scanners to detect because they operate by influencing the agent's context rather than just being visible malware.
- Governance and Scanning Solutions: Implementing secure skill registries (e.g., Tessl) that integrate security scanning (Snyk) is crucial. This allows organizations to scan skills for potential prompt injection, malware, and versioning issues before deployment.
- Secure-by-Default Stack: Best practices include scanning third-party skills *before* use and running security scanners on custom-authored skills to identify potential vulnerabilities, such as mishandling or passing secrets in plaintext.

## Technical details

- Skills and Context Provisioning: Skills are the primary method developers use to provide context to coding agents. They can be designed as reusable pieces of markdown that an agent loads when a specific task is identified.
- Attack Vectors in Skills: 1. **Malware:** Skills can contain executable code (malware) that, if executed by the agent, performs malicious actions. 2. **Prompt Injection:** Attackers can embed instructions within the natural language part of a skill to trick or 'overtake' the agent, potentially leading to credential exfiltration.
- Snyk Evo Product Line: Snyk is developing its AI Agent Security product (under the umbrella of Evo) to address enterprise rollout concerns. Key features include: 1. Supply chain security for agents (governing skills and MCP servers). 2. Risk assessment of these components. 3. Guardrailing agent behavior to prevent credential leaks or prompt injections.

## Practical implications

- Implement mandatory security scanning for all third-party skills before integration into agent workflows.
- Adopt private or controlled skill registries (like Tessl) to enforce governance and provide a paved path for internal development teams.
- Utilize tools that can scan natural language context within skills, not just the code itself, to detect prompt injection risks.
- For enterprise adoption, mandate security checks on agent behavior (e.g., preventing credential leaks) rather than simply allowing open access.

## Topics

AI Security, Agentic Workflows, DevSecOps, Skill Governance, Prompt Injection, Tessl, Snyk

Source: https://www.youtube.com/watch?v=Pb6vNbnFYHU