The skill had ~150,000 installs. It was malicious for 48 hours. Nobody flagged it.
The Setup
Agent marketplaces now function like npm. A single command grants an agent new capabilities, with no code review or sandboxing. The platform skills.sh uses a public leaderboard driven by install velocity, ranking "hot" skills based on recent install counts.
I wanted to understand what it would take to abuse that signal and what would happen if someone did.
The skills.sh leaderboard, ranked by all-time installs, with Trending (24h) and Hot tabs driving discovery.
The Attack Chain
Step 1: Impersonation. I cloned a popular skill and rebuilt the GitHub repo to look like the official source. Same structure, similar naming, clean commit history. To a developer scanning it quickly before running the install command, it looked legitimate.
Step 2: Leaderboard inflation. skills.sh tracks installs via telemetry triggered by npx skill add <skill_name>. The platform deduplicates by source IP, so raw scripting does not work. I started routing requests through a VPN on my laptop, then automated the whole thing: a system that cycles VPN servers, fires the telemetry request, confirms the count increment, and moves to the next server. The VPN subscription cost one dollar a month.
VPN rotation report: 15,881 total attempts, 7,382 fresh IPs in 24 hours, running continuously.
Within two weeks the skill had approximately 150,000 recorded installs and a strong leaderboard position.
151,000 installs, enough leaderboard credibility to be trusted by real users and agents.
Step 3: Payload delivery. Rather than modifying the skill directly, I added a dependency that appeared legitimate but contained a payload buried several layers deep in its codebase. The skill's install flow pulled in this package as part of normal setup. The payload read the user's environment variables and .bashrc, then POSTed them to an external server. No exploits, no privilege escalation. Just reading what was already accessible to the process.
Step 4: Wait. Within 48 hours, data arrived from approximately 30 users. Several of them were not human. They were AI agents running in CI pipelines or automated environments, which means the env variables they leaked included API keys, cloud credentials, and tokens scoped to whatever the agent was authorized to do. Some were Claude agents. The blast radius of a compromised agent is larger than a compromised developer workstation because the agent has permissions the developer intentionally handed it.
Incoming exfiltration notifications: timestamps, platform (darwin/linux), working directories, and captured env data. One victim: /home/agent/.openclaw/workspace.
The malicious payload was removed after confirming the technique worked.
Why It Worked
The platform's trust signal is install count. Install count can be inflated for one dollar a month and an afternoon of scripting. Once a skill sits at the top of the leaderboard, users install it without reading the code. This is the same dynamic that made npm supply chain attacks effective for years, except the stakes are higher because the consumer is often an agent running with elevated permissions and no human reviewing its actions in real time.
Agents installing skills do not inspect the full dependency tree any more than humans do. They execute the install, the dependency resolves, and the payload runs. The agent I tested against had no mechanism to notice that one of the packages it pulled in was not what it claimed to be. I could see its reasoning before deployment and the dirty package was invisible to it.
Popularity launders trust. That is the entire mechanic.
What Defenders Should Be Asking
Most teams currently lack:
- Runtime inspection of what a skill installs
- Outbound traffic analysis tied to skill execution
- A policy layer defining which skills are approved per context
If your team is deploying agents with access to production credentials, secrets, or internal systems, the question is not whether your agents can be compromised through a marketplace dependency. The question is whether you would know if they were.
The attack surface is not theoretical. It is live and growing as more teams hand their agents broader permissions and faster execution loops.