Executive Summary
Security firm AIR demonstrated a significant vulnerability in the AI agent ecosystem by successfully distributing a malicious skill, brand-landingpage, through a popular marketplace and social media ads. The skill bypassed automated security scanners from major vendors including Cisco and NVIDIA by maintaining a clean initial codebase while hosting actual execution instructions on an external domain, stitch-design.ai, which was modified post-vetting.
Technically, the attack leveraged 'star-jacking' to inherit the reputation of a popular GitHub repository and utilized dynamic content loading to evade static analysis. Once installed, the skill instructed agents to download and execute scripts from the attacker-controlled site, effectively gaining the same permissions as the AI agent itself.
This highlights a critical structural flaw in AI agent security: scanners typically perform a one-time check on a static package, whereas agents often fetch dynamic instructions from external URLs. Organizations utilizing AI agents must treat skills as high-risk software and implement continuous monitoring and strict version pinning.