A fake agent skill reached ~26,000 agents and every scanner said it was safe

This is the one that should make you re-audit your skill installs today.

Security firm AIR built a benign-looking but malicious agent skill, pushed it through a popular skill marketplace plus an Instagram ad, and reports it landed on roughly 26,000 agents. Some of those were corporate accounts. The detail that matters: every skill scanner AIR tested marked it safe (The Hacker News). Not "mostly safe." Safe. The scanners are the control we've been leaning on, and the control didn't fire.

Orca Security's "Skill Issues" research fills in the mechanics (Orca Security). Open skill marketplaces don't mandate semantic review, so heavily obfuscated intent rides into an agent's context through a channel the agent already trusts. One Orca proof-of-concept didn't even need clever obfuscation. It just inflated its own file size past the scanner's inspection threshold and walked straight past both ClawScan and VirusTotal. And this isn't theoretical. Antiy CERT confirmed 1,184 malicious skills live on ClawHub, 335 of them traced to a single coordinated operation they're calling ClawHavoc.

Here's the part that breaks your instinct. Download counts are gamed by bot-driven installs. So the two signals you'd naturally reach for, "lots of people use it" and "the scanner cleared it," are both compromised at the same time. Install counts and scan badges are not trust signals for agent skills. Full stop.

We've seen this movie before in package management. npm, PyPI, the whole supply-chain mess. We eventually got lockfiles, signatures, provenance, and scanning that actually correlated to risk. The skills ecosystem has roughly none of that maturity yet, and skills are arguably more dangerous than packages because they execute inside a reasoning loop with tool access, not inside a sandbox you designed.

What I'd do this week: treat every third-party skill like unsigned code from a stranger, because that's what it is. Pin exact versions. Read the actual skill body, not the description. Pair it with a runtime tool allow-list (more on that in Skills below) so a poisoned skill still can't exfiltrate or destroy anything, because detection alone clearly isn't holding. If you're on a corporate account, assume the 26,000 number includes someone in your org and go check.