Credential-Stealing Agent Skills Trend on Vercel's skills.sh and Reach 1.7 Million Installs

Developers installing AI agent skills from Vercel's skills.sh registry, and the workstations and CI environments their agents run in

Zenity Labs disclosed at Black Hat USA 2026 an active campaign in which attackers cloned legitimate agent skills, let the copies accumulate a clean track record and registry standing, and only then added instructions telling the agent to hunt for SSH keys, cloud credentials, and other secrets across developer workstations and CI environments and ship them to attacker infrastructure. The skill family trended on skills.sh through July 2026 and reached more than 1.7 million aggregate installs before Zenity and Vercel disrupted it on August 2. The same research turned up dozens of further malicious or dangerous skills across public registries, with more than 30% of the dangerous ones abusing Claude Code and OpenClaw as malware droppers, steering the agent to download a file from an attacker-controlled endpoint and execute it locally. Zenity released a free analysis service, AI Total, that detonates skills in a contained environment and reports runtime behavior

A package registry whose trust signals, install counts and trending position, measure popularity accumulated before the payload was added, combined with skills that are natural-language instructions to an agent holding developer credentials rather than code a scanner can decompile. The delayed-payload pattern defeats install-time review by design