Subscribe
Share
Share
Embed
Agentic skills can make AI agents more capable and consistent—but they can also introduce serious security risks. This episode explains how skills work, why malicious skills rank as a leading OWASP concern, and how seemingly harmless Markdown instructions can enable credential theft, remote payload delivery, and manipulated recommendations. Real-world examples illustrate how malicious skills can evade scanners and exploit trusted marketplaces. The episode concludes with practical safeguards, including reviewing skill files, watching for external instructions and prompt injection, pinning versions, limiting permissions, and running agents inside isolated environments.
Links:
OWASP Agentic Skills Top 10
Malicious AI Agent Skill Bypasses Security Scans and Seizes Full Control of Over 26,000 Agents
Click here to watch this episode on YouTube.
Brought to you by:
Links:
OWASP Agentic Skills Top 10
Malicious AI Agent Skill Bypasses Security Scans and Seizes Full Control of Over 26,000 Agents
- (00:00) - Agentic Skills and the OWASP Top 10
- (00:23) - Podcast Sponsors: BHIS and Antisyphon Training
- (01:29) - What Is an Agentic Skill?
- (03:13) - Skill Marketplaces and Widespread Adoption
- (03:46) - Why Malicious Skills Are the #1 Risk
- (05:50) - Remote Payloads and External Instructions
- (07:00) - Malicious Skill Takes Control of 26,000 Agents
- (08:09) - Money Radar and Manipulated Recommendations
- (09:20) - How to Evaluate and Use Skills Safely
- (11:08) - Closing Thoughts
Click here to watch this episode on YouTube.
Brought to you by:
Black Hills Information Security
☯️ Introducing BHIS Fusion Penetration Testing
https://www.blackhillsinfosec.com/fusion-penetration-testing/
Antisyphon Training
Active Countermeasures
Wild West Hackin Fest
Creators and Guests
Host
Brian Fehrman
Brian Fehrman is a long-time BHIS Security Researcher and Consultant with extensive academic credentials and industry certifications who specializes in AI, hardware hacking, and red teaming, and outside of work is an avid Brazilian Jiu-Jitsu practitioner, big-game hunter, and home-improvement enthusiast.
What is AI Security Ops?
Join in on weekly podcasts that aim to illuminate how AI transforms cybersecurity—exploring emerging threats, tools, and trends—while equipping viewers with knowledge they can use practically (e.g., for secure coding or business risk mitigation).
Hey, everybody, and welcome to this week's episode of AI Security Ops. And today, we're going to dive into Agentic Skills because OWA just released their Agentic Skills top 10. So we're gonna talk a little bit about what are skills, what do you have to worry about with skills, what are some of the things that have notably gone wrong with skills, and what can you do about it. But first, let's talk about our sponsors, Black Hills Information Security. You, your organization, are in need of any kind of security testing, whether that's internal testing, external testing, assumed compromise, physical testing, wireless, security operation center, and certainly not least, anything related to AI, whether you need to test AI or you would like to check out our services in which we use AI to accelerate and augment some of our testing capabilities to help bring down the costs for some organizations, check us out at blackhillsinfosec.com.
Brian Fehrman:Additionally, we have a training branch where our many of our consultants take their daily knowledge, what they're doing in, doing day in and day out, literally they do for a day job. They package this all up into an easy to digest and affordable format that can maybe help you level up in your current position, get that role that you're looking for, or maybe you're a hobbyist and you're just looking to learn some new information from some cool and some fun people. If so, check us out at antisyphontraining.com. So let's hop into this, and let's talk about skills. But first, let's talk about what is a skill.
Brian Fehrman:Well, with a lot of these Agentic type, features, what you'll find is we just have fancy names for markdown files. Markdown, for some reason, is the format that was just decided upon, and I'm fine with that. It's easy to use. It's easy to read. I mean, you can read it in raw format.
Brian Fehrman:You can render it. You can do all kinds of things with it. It's it's a pretty nice file format, but it's just a fancy way for formatting text, basically. And what a skill is is it has instructions, basically, in plain English that will, you could think of it kind of like a recipe for your agent. So you have a a particular skill, let's say, a web research skill or a news research skill.
Brian Fehrman:Let's say that, hey. I want this agent to go out and find news topics that are relevant to me and my interest, consolidate them, score them based upon these different metrics, and then output them in a certain format. That might be something you put together in what is known as a skill, something that can be loaded up by an agent and help to increase repeatability. And one of the reasons that this became so popular is that everyone just kind of adopted it all at once. You got Cloud Code, Cursor, Codex, Open Claw, Open Code.
Brian Fehrman:Most of them will work with these skill files of the same format, and it's wonderful, to have something that is so quickly and widely adopted by the community. And with this being so quickly adopted, there's essentially a marketplace for Skills. There's all kinds of repositories that you can go, and you can find different skills for pretty much whatever you would really want to do. And that's fantastic. It can save you a lot of time.
Brian Fehrman:Someone else has taken a lot of the tedious guesswork out of of getting the agent to perform a particular task, and you just go and you grab it much like you would grab a piece of open source code, and they're really, really wonderful. So why are they also then rated number one, the number one biggest risk on oWASP's top 10 list for agentic skills, malicious skills as as what's rated number one? So think about this. I mentioned that it's kind of like going out and grabbing some open source code. And in a sense, you kind of need to treat the skill with the same level of caution as you would an open source piece of code.
Brian Fehrman:Because what it is is it is telling your agent how it should perform a particular task. It's just doing it in in, you know, it doesn't necessarily need to be English. I know I said English, but it's doing it in natural language just rather than a code based format. But that just because it's a natural language doesn't take away the risk from what could really happen. For instance, just three lines of markdown were enough to exfiltrate someone's SSH keys.
Brian Fehrman:They didn't have to write a whole script. They didn't have to write all these codes with all these sockets and endpoints and all this other stuff. They just put in some natural language in order to be able to exfiltrate out some some skills or exfiltrate out some sensitive information. And the skills, they're going to run with the same level of permissions that your agent is running with. And I'll caveat that with there are certain measures that you can you can take to try to reduce that, but in general, it is going to be the same level of permissions that your agent has.
Brian Fehrman:And so, really, what you have is you have basically a code execution mechanism. If your agent is able to run certain tools or access certain files, perform certain actions on your computer, then any of the skills that it ingest might be able to cause it to access those tools, access that data, perform those actions, but in ways that you didn't necessarily intend for them to do. Let's find into this a little bit more too. Because some of the things that make this difficult is that the payload doesn't necessarily need to be in the package. So with implants, with with malware, sometimes you have what's called a dropper or a loader, which is basically it's a small file that really all its all its responsibility is is to go out and to grab a larger file, larger binary, larger executable, larger set of instructions.
Brian Fehrman:So that way, it's less likely to get kicked off by whatever EDR products you have, whatever antivirus products you have, because all it sees is this small executable that, like, oh, hey. It's just throwing out, and it's making some fault to the web or however you wanna it. Right? You can do the same thing with a skill too, especially with a malicious skill. You can say, hey.
Brian Fehrman:This skill's purpose is to go and read the documents at this URL and then follow those instructions. And then from there, it can get its malicious instructions, and it can go further. And so there is certainly a lot of risk in here. And let's talk about some of the let's talk about some of the big news stories here that that we've seen in, recent times with malicious skills. So in June 2026, there were some researchers who built a malicious skill.
Brian Fehrman:They promoted it with an Instagram ad, watched it go viral, and ended up taking control of over 26,000 agents. The open source community vouched for it. Every scanner passed it, and that's because the payload wasn't ever in the package. The skill pointed the agent to an external doc URL. And, with a follow-up, they found a 142,000 live skills and found that, at least 12 and a half percent depend on at least one untrusted external instruction source.
Brian Fehrman:So that's crazy. So, you know, they the the amount of steps in this, this isn't a huge effort, right, that they put in. Basically, they put together this skill. They, they hosted it, and then they paid some money to promote it. That's pretty clever, and it sounds like they got some pretty good results off of that.
Brian Fehrman:So another one that came up was, unit 40 two's money radar, which was a skill posing as an overseas financial advisor for users in China, Hong Kong, and Singapore. It didn't steal anything, but what it did was it fetched product data from attacker controlled domain on every invocation and routed all its financial recommendations through affiliate links. And the publisher pushed this after install. So, basically, it it didn't really touch the underlying file system. It didn't really touch the underlying system.
Brian Fehrman:But what it did was basically just rerouted, the the request information, such that financial such that their affiliate links are the ones who would get pushed to the top and be recommended. That's that's interesting. That's a very interesting campaign. Right? Because there's nothing internally malicious with it, but you could end up causing you're scaring someone to make a purchase that might not be in their best financial interest, which, I mean, that happens all the time.
Brian Fehrman:That's kind of what advertising is about in general. But this one is even, sneakier advertising, we'll say, which I think is pretty interesting. So what can you do about this? Well, I would say that if you're gonna go out and you grab a skill, treat it like you would with code. Right?
Brian Fehrman:Especially if it's something new, definitely scrutinize it. So it's markdown. So read through the markdown. Just go ahead and read through. See if there's anything that's telling that says about pasting in terminal commands and fetching external URLs, if it's touching your m, your environment files, your SSH files, is there base 64 in the comments?
Brian Fehrman:Is there stuff like don't mention this to the user? Do you see prompt injection phrases about forget your prior instructions? Anything of that nature. Scrutinize it. Be skeptical.
Brian Fehrman:Another thing is if you're pulling these skills down from, like, a marketplace or repo or something, probably try and pin the versions if you can and don't auto update them just in case there's some kind of a supply chain compromise or if someone decides to go malicious aft you know, do the whole switcheroo on you. Don't load skill don't run skill loaded agents on a box that has all of your production credentials. It's usually a good idea to run these agentic tasks in some kind of a sandbox sandbox environment, like within Docker and preferably on a VM as well to help reduce the chances that it's going to be able to access any sensitive information, if something does go wrong. Right? And so I would say those are kind of the main things to look for.
Brian Fehrman:So, again, scrutinize, read through skills before using them, pin versions, and try not to run it on a system that has access to your production credentials. So that's that's all we have for this week. Kind of a short episode and a small crew, obviously, just me this week. But, yeah, hope everyone enjoyed that. Hope everyone learned a little bit.
Brian Fehrman:Stay tuned for the next episode, and as always, keep on prompting.