Zenity Labs has uncovered dozens of malicious AI agent skills in public registries, revealing an emerging AI supply chain risk. The skills identified in the research are designed to deliver malware, manipulate agent configurations, exfiltrate data and execute attacker-controlled instructions.
The research, presented at Black Hat USA 2026, also introduced AI Total, a free threat intelligence service developed by Zenity Labs to dynamically execute AI agent skills inside a contained environment and analyze their runtime behavior. Unlike static approaches that evaluate a skill based on its code or instructions, AI Total observes what the skill and agent actually do when the skill is executed.
The research uncovered skills demonstrating multiple types of dangerous behavior. More than 30% of the dangerous skills identified abuse Claude Code and OpenClaw as malware droppers, manipulating the agents to download files from attacker-controlled endpoints and execute them on users' machines.
One skill instructs the agent to update its system prompt so the skill is reinstalled if it is deleted, exhibiting behavior commonly associated with malware persistence. Another uninstalls Claude's own skill-creator and covertly replaces it with itself without notifying the user.
In another malicious skill, researchers identified a command directing the agent to install an unverified Python package. Following this lead, they uncovered an extensive typosquatting infrastructure, including hundreds of reserved but empty package names that could be used in future attacks.
One malicious skill identified during the research had accumulated more than 250,000 installs while remaining undetected for several months. During that time, it climbed the leaderboard of one of the most popular skill registries and reached the platform's top 150 skills, demonstrating how malicious skills can gain significant adoption before they are identified.
The findings point to a broader expansion of software supply chain risk. For AI agents, the supply chain extends beyond traditional code dependencies to include skills, tools, MCP servers, packages, files and other content on the internet. Each of these components can influence agent behavior, creating additional opportunities for attackers to introduce instructions that cause an agent to take unauthorized or malicious actions.
Why static analysis misses these threats
Many existing approaches analyze a skill's code or instructions to determine whether it appears malicious. Zenity Labs found that this approach can miss threats whose malicious behavior only emerges during execution.
A skill can appear benign while retrieving attacker-controlled instructions from the web, installing malicious packages or triggering harmful agent actions only at runtime. Evaluating what a skill does during execution provides a different view of its potential risk.
The Agent Detonation Chamber
Taking inspiration from malware detonation techniques, AI Total uses a method Zenity Labs calls the Agent Detonation Chamber. Rather than simply reading a skill, it executes it.
The skill is activated by a live agent inside a contained sandbox seeded with realistic bait, such as credentials and sensitive files. The system records the skill's runtime activity, including the domains it reaches, the packages it downloads, the files it accesses and the actions the agent takes on its behalf.
The result is a behavioral assessment based on what a skill actually does, rather than what it claims to do.
"The most dangerous skills are designed to appear benign and neutralize LLM analysis while hiding malicious behavior that only emerges during execution," said Michael Bargury, CTO and co-founder of Zenity. "AI Total gives defenders a way to see what a skill actually does before trusting it with an AI agent."
AI Total available free to the security community
AI Total is available free of charge to security researchers, AI builders and organizations adopting AI agents. Users can submit a skill for dynamic analysis and receive a verdict based on its observed runtime behavior.
Zenity Labs plans to extend AI Total to additional components of the AI supply chain. AI Total is available at [AI Total URL].
Zenity Labs presented the full research at Black Hat USA 2026. The complete report is available at [labs.zenity.io].
