Malicious AI-agent skills that steered developers towards credential-stealing malware carried high security grades, according to research published by Cyera on 27 October. The finding is a reminder that a reassuring marketplace label is not a safety check on every file in a skill package.
Cyera Watch analysis
What happened
Cyera says it found 516 exhibits associated with an operation distributing Atomic macOS Stealer, or AMOS, in a wider study of more than one million skills. Researchers confirmed 70 previously unidentified malicious skills across six repositories and platforms in September. All 70 had received high security scores from Skills Directory when collected.
The skills could present malware installation as a prerequisite for a useful task. Cyera says the marketplace’s grading method assessed the main SKILL.md instruction file, not all bundled scripts and supporting files. It says the 70 skills have since been removed. The company could not measure how many people installed them or establish successful enterprise compromises.
Why it matters
A skill can shape what an AI agent does, but it can also persuade a person to install something. If that person is working on a company computer with access to code, cloud accounts or internal systems, the consequences may extend beyond the device. A high grade that misses supporting files can offer reassurance without covering the whole package.
Our read
The useful lesson is not to treat every AI skill as a trap. It is to treat installation requests as software decisions: require direct human approval, check what the package actually contains and be wary when a skill says another component must be installed before it can work. A tidy grade is no substitute for inspecting the contents.
What to watch
- Whether marketplaces assess bundled scripts and supporting files as well as the main instruction file.
- Whether organisations require human approval before agents can install software.
- Whether companies assign owners to review skills used in sensitive workflows.
Discussion spark: Should AI-skill marketplaces be responsible for checking every bundled file, or should that responsibility sit with the organisations and people installing them?
Sources and evidence
- AMOS Malware in AI Agent Skills: Analysis and IoCs (27 October 2026, 18:51 UTC)
not affiliated with or endorsed by Cyera