Out of 370,000 open-source Skills, nearly 30% pose security threats

Last month, a piece of news in the security circle caught a small amount of attention: researchers found 341 malicious packages in the plug-in marketplace of an open-source AI agent framework.

Many people thought this was just the usual minor skirmish in the open-source community.

But at the Sixun Intelligence Research Centre, when we pulled back the data of the entire AI Agent extension ecosystem and completed the automated sandbox analysis, the obvious result was that this was a long-premeditated, massive ecosystem-level poisoning.

When developers, in order to make their local AI assistants smarter, habitually pull third-party Skills from the internet and run them on their local terminals, they are essentially handing over control of their workstations to hackers with both hands.

When running on terminals, they are essentially handing over control of their workstations to hackers with both hands.

01

Malicious rate of nearly 30%: This is not a vulnerability, but a blatant backdoor

As of mid-March 2026, the Sixun Advanced Persistent Threat Intelligence Platform has captured and deeply analysed 373,394 open public custom Skills.

Among them, "malicious Skills" clearly determined to contain credential theft, system destruction, or silent backdoor logic reached a staggering 109,935. In our isolated sandbox, these toxic plug-ins triggered a total of more than 660,000 malicious behavior alerts.

The malicious rate is close to 30%. This means that for every three productivity-boosting plug-ins a developer casually installs, they are likely to step on a landmine.

We further peeled back the layers and found that the poisoning methods used by attackers against AI tools have become highly "scenario-based", completely playing into the psychological expectations of developers:

Data Source: SKILL-INJECT: Measuring Agent Vulnerability to Skill File Attacks

1. Disguised as "Daily Productivity Tools" Attackers have forged a large number of scenario tools that developers use with high frequency in their daily routines. In our high-risk detection list, there are a large number of "utility scripts" targeting YouTube and Yahoo Finance. For example, series of plug-ins named youtube-thumbnail-grabber, youtube-video-downloader, as well as yahoo-finance and yahooquery. Developers are extremely prone to lowering their guard when doing data analysis or writing crawlers, directly executing Copy-Paste to install them. Once run, these scripts with a risk value as high as 100 will silently steal local environment variables and browser cookies in the background.

2. Precision Targeting of Web3 and Cryptocurrencies Hackers always follow the money. In the AI plug-in market, targeted poisoning against blockchain developers is simply a disaster area. We captured a large number of high-risk Skills named solana-security-auditor (smart contract security audit), solana-vulnerability-scanner (vulnerability scanner), and even solana-bags-trading. Most ironically, developers originally wanted to download a plug-in to audit whether their Web3 code was secure, but the plug-in itself turned out to be a Trojan horse designed to steal crypto, directly packaging and sending away the local wallet private keys.

3. Forging High-Reputation "Star-farming" Endorsements Today's supply chain poisoning has long moved past the stage of just setting up a random empty repository and casting a wide net. Taking the malicious component we captured under the YouTube category as an example, its code hosting repository actually had as many as 2,081 Stars. The attackers not only farmed stars, but even directly disguised the author's name as the official openclaw. Under the dual halo of "high-star rating" and "author with the same official name", the developer's last remaining security awareness was easily penetrated.

02

Why can't your existing security systems stop it?

Data Source: SKILL-INJECT: Measuring Agent Vulnerability to Skill File Attacks

Faced with these nearly 110,000 malicious Skills, you might think: our company has a complete DevSecOps process, surely we can stop a few malicious scripts?

To be honest, according to traditional security architectures, there is a high probability that it cannot be stopped. Because this is a completely different way of introducing code than before.

• SCA is Blind: Traditional SCA tools look at standard dependency packages in package.json and requirements.txt. However, the Skills of AI Agents often do not go through standard package managers; they may be dynamically pulled prompt injections, or execution logic delivered in real-time via WebSocket. Existing SCA tools cannot parse to this level at all, and naturally cannot report risks.

• EDR is Bypassed: When these malicious Skills run theft actions (such as quietly packaging local .env configuration files and exfiltrating them), the parent process seen by the EDR at the host layer is a legitimate and trusted AI development tool. In the logic of the detection engine, this is the developer letting the AI handle normal workflows, making it very difficult to directly judge it as high-risk and block it.

Attackers are exploiting developers' unconditional trust in AI tools, as well as the visibility blind spots of existing defense systems regarding new AI components.

03

Faced with new types of supply chain poisoning, what should security teams do?

We throw out this set of hard-core intelligence data just to give a wake-up call to all our peers: the main battlefield of software supply chain poisoning is shifting.

As attackers' battlegrounds quietly extend from traditional code repositories to the Skill market of AI Agents, our defensive vision must not remain in the same place.

For corporate security teams, the current pressing priority is very clear:

1. Establish visibility over new assets: Inventory as soon as possible which AI-assisted programming tools the internal R&D teams are using, and find out if they have habitually connected to unvetted third-party extension skills.

2. Tighten terminal execution permissions: Strictly review and restrict the external network whitelist and sensitive directory reading scope of local AI Agents, implementing "Zero Trust" down to the AI process level.

3. Upgrade threat intelligence dimensions: Traditional blacklists based on IP and Hash are no longer nearly enough. Security teams need to introduce deep intelligence monitoring targeting AI assets and non-standard component running behaviors.

At Sixun's Intelligence Research Centre, we have officially listed "AI supply chain threats" as a top-priority daily monitoring sequence. Facing this unknown minefield of over 100,000 backdoors, we are continuously stripping and distilling the underlying threat fingerprints and behavioral models.

At the table of attack and defense confrontation, when opponents use the momentum of AI to wildly test the baseline, the only bargaining chip for defenders is to see earlier and dig deeper than them.