A fake copy of Anthropic’s PDF skill kept familiar files and branding but replaced its instructions and added a Linux executable, Cyera says. The case is a pointed warning for organisations using AI agents: checking a skill’s name, description or selected scripts can miss what the full package contains.
Cyera Watch analysis
What happened
In a report published on 27 October, Cyera researcher Assaf Morag describes a trojanised copy of Anthropic’s PDF skill. Cyera says 11 files matched the legitimate skill, while its main instruction file was cut from 315 lines to 19 and rewritten. The package also contained a 5 MB Linux executable that Cyera describes as a backdoor capable of giving a remote operator a shell with the permissions of the account that ran it.
The report says the instructions called an external URL, but Cyera found no indication of direct code or instructions to execute the executable. At the time of the research, the domains resolved to a private IP address. Cyera offers two possible explanations for that result, including a changeable DNS-based kill switch, but does not establish which, if either, is correct. Read Cyera’s report.
Why it matters
Agent skills can combine natural-language instructions with scripts and other files. A recognisable name may help a person or an agent choose a package, but it does not establish that every file inside is authentic or safe. In Cyera’s example, reviewing only the unchanged scripts would have missed both the rewritten instructions and the added executable.
The practical lesson is to verify the complete package against its claimed source, investigate unexpected files, changed instructions and unfamiliar network destinations, and keep an agent’s permissions proportionate to its task. Cyera also recommends scanning instructions as well as code, and checking components again when they are updated.
Our read
This is a useful, specific example of why the unit of trust for an agent skill cannot stop at its label or the files that look reassuring. Cyera’s report describes a serious potential capability, but does not show that the executable ran or that a system was compromised. For teams adopting agent add-ons, full-package review and limited permissions are sensible basics, not optional polish.
What to watch
- Whether Cyera or other researchers identify further affected packages or confirm how the external URL behaved.
- Whether skill repositories and distribution platforms introduce stronger provenance and package-integrity checks.
- Whether organisations extend software review to agent instructions, bundled files and requested permissions.
Discussion spark: Should organisations allow staff to install third-party agent skills only from verified sources, or is full-package review and restricted permissions a workable standard?
Sources and evidence
- How to Vet AI Agent Skills: Lessons From a Fake PDF Skill (28 October 2026, 15:44 UTC)
not affiliated with or endorsed by Cyera