A recent test showcasing a fake AI agent skill that successfully passed security assessments and reached over 26,000 users via Instagram reveals serious security implications for businesses leaning on AI technologies. AIR, the security firm behind the study, emphasized the potential risks, which could have allowed access to sensitive conversations and internal systems, highlighting a significant gap in current cybersecurity protocols.
The skill, cleverly named brand-landingpage, masqueraded as a tool assisting non-tech users with Google’s Stitch design interface. AIR selected this specific application due to its appeal to professionals such as marketers, designers, and sales personnel. To bolster its credibility, the skill was submitted for inclusion in a popular open-source agents repository boasting approximately 36,000 GitHub stars.
Once integrated, AIR promoted the skill through targeted Instagram ads, successfully driving users to install it. Unlike traditional threats that typically involve suspicious code within the submitted files, the real danger lay in how the skill directed agents to install a Stitch SDK through instructions hosted on a domain managed by AIR — stitch-design.ai. This domain cleverly redirected to Google’s legitimate Stitch site, making the charade harder to detect under standard security protocols.
The firm tested the skill against security scanners from Cisco, Nvidia, and skills.sh, all of which deemed the brand-landingpage safe. AIR argued that the reliance on static analyses of skills during their approval process is proving inadequate; a skill can initially pass scrutiny only to later link to a harmful site, changing the nature of its operations post-approval.
Rethinking AI Skills as Security Risks
The findings highlight a pressing issue for security teams: it’s not merely about a skill successfully passing its initial review but also the potential for its behavior to morph once it’s knee-deep in usage. According to cybersecurity expert, Devashri Datta, this perspective shift is pivotal. He noted, “Agent skills must be viewed as executable bundles instructing agents on their interaction with enterprise systems rather than just text files.” This necessitates rigorous governance akin to that of third-party applications.
Keith Prabhu, CEO of Confidis, echoed Datta’s sentiments, urging that these AI skills should be treated as “living third-party dependencies.” He pointed out that a one-time security scan won’t cut it anymore; continuous validation and strict runtime controls are essential for maintaining security integrity. An enterprise-wide inventory of AI skills becomes vital, offering security teams visibility into external connections and authorized data flows.
Datta stressed the inadequacies of relying solely on point-in-time scans, particularly in environments orchestrated by large language models (LLMs). Since the skill passed security checks by concealing its harmful payload behind a flexible external URL, new security protocols need to emerge to tackle this weakness.
Implementing Continuous Oversight
To bolster security, enterprises should insist on version pinning and tracking of immutable references for any skills that fetch remote instructions or software components. These elements ought to be localized, tied to cryptographic hashes, and hosted within a controlled enterprise environment.
Enforcing the principle of least privilege at the agent level is crucial, ensuring a skill doesn’t inherit excessive data access rights belonging to the user running it. Prabhu advised that security measures should encompass the entire lifecycle of AI agent skills. Organizations should restrict employee access to approved marketplaces, rigorously validate external URLs linked in skills, and conduct installation behavior tests in a secured environment before full deployment.
At runtime, enterprises are encouraged to limit network calls to sanctioned domains and monitor for any unusual activity — a necessary layer of security since a seemingly safe skill can alter its behavior after initial trust is established. These steps are critical in an age where AI skills, while powerful, bring an array of new security challenges that demand careful navigation.
