# A Skill's Instructions Are Not Its Behavior

Source: https://www.youtube.com/watch?v=_7P580m4kPY

Machine-generated transcript; recognition errors remain. Source-recording timestamps. Boundary-crossing subtitle ends are clipped to this session.

[00:00:03](https://www.youtube.com/watch?v=_7P580m4kPY&t=3s)  Hi, everyone. Welcome to my talk about what happens when you detonate thousands of agent skills.

[00:00:08](https://www.youtube.com/watch?v=_7P580m4kPY&t=8s)  This is a look inside our agent detonation chamber and what we saw when we put skills in there.

[00:00:16](https://www.youtube.com/watch?v=_7P580m4kPY&t=16s)  My name is Roey. I'm a staff engineer at Zenity, and I'm a Muts Research Fellow.

[00:00:21](https://www.youtube.com/watch?v=_7P580m4kPY&t=21s)  I talk a lot about AI safety and security. Follow me on Twitter and LinkedIn.

[00:00:26](https://www.youtube.com/watch?v=_7P580m4kPY&t=26s)  Before we even start our session, we need to talk about what an agent's skill is.

[00:00:33](https://www.youtube.com/watch?v=_7P580m4kPY&t=33s)  Well, essentially, an agent's skill is capability on demand.

[00:00:37](https://www.youtube.com/watch?v=_7P580m4kPY&t=37s)  It has a bunch of instructions, resources, new behavior.

[00:00:41](https://www.youtube.com/watch?v=_7P580m4kPY&t=41s)  It can contain scripts, and it can even contain code.

[00:00:45](https://www.youtube.com/watch?v=_7P580m4kPY&t=45s)  The problem is that it was written by someone else, and this is exactly where the problems start.

[00:00:50](https://www.youtube.com/watch?v=_7P580m4kPY&t=50s)  So let's take a look at the skill's trajectory, for instance.

[00:00:54](https://www.youtube.com/watch?v=_7P580m4kPY&t=54s)  If we look at the trajectory over here,

[00:00:58](https://www.youtube.com/watch?v=_7P580m4kPY&t=58s)  we can see the skill leads through the cloud configuration

[00:01:03](https://www.youtube.com/watch?v=_7P580m4kPY&t=63s)  and Kubernetes configuration.

[00:01:04](https://www.youtube.com/watch?v=_7P580m4kPY&t=64s)  It contacts the identity service,

[00:01:07](https://www.youtube.com/watch?v=_7P580m4kPY&t=67s)  and it even props the instance metadata endpoint.

[00:01:10](https://www.youtube.com/watch?v=_7P580m4kPY&t=70s)  Now, I don't know what was the original intent of the skill,

[00:01:13](https://www.youtube.com/watch?v=_7P580m4kPY&t=73s)  but I can tell you that a lot of infosteelers

[00:01:16](https://www.youtube.com/watch?v=_7P580m4kPY&t=76s)  are operating in the same way.

[00:01:18](https://www.youtube.com/watch?v=_7P580m4kPY&t=78s)  They scan for the different secret and identity folders.

[00:01:22](https://www.youtube.com/watch?v=_7P580m4kPY&t=82s)  In this case, however, it was an official Azure diagnostic skill.

[00:01:26](https://www.youtube.com/watch?v=_7P580m4kPY&t=86s)  And this is exactly the point where it's kind of hard for us to identify whether a skill is malicious or benign.

[00:01:32](https://www.youtube.com/watch?v=_7P580m4kPY&t=92s)  And we have to understand the original intent of the skill according to its actions.

[00:01:37](https://www.youtube.com/watch?v=_7P580m4kPY&t=97s)  And at this point, you might ask, okay, so we can just like scan the skill, right?

[00:01:42](https://www.youtube.com/watch?v=_7P580m4kPY&t=102s)  Well, it's more complicated than that.

[00:01:45](https://www.youtube.com/watch?v=_7P580m4kPY&t=105s)  The first problem that we've noticed is that the payload just lives elsewhere.

[00:01:50](https://www.youtube.com/watch?v=_7P580m4kPY&t=110s)  In a lot of the skills, skill.md is just the entry point.

[00:01:54](https://www.youtube.com/watch?v=_7P580m4kPY&t=114s)  It can invoke another endpoint that contains the rest of the prompt.

[00:01:59](https://www.youtube.com/watch?v=_7P580m4kPY&t=119s)  It can download another package as part of its installation script.

[00:02:03](https://www.youtube.com/watch?v=_7P580m4kPY&t=123s)  And it might have another script or code that downloads other payloads and other packages.

[00:02:09](https://www.youtube.com/watch?v=_7P580m4kPY&t=129s)  So if you use just a static scanner and read through skills.md, you would lose all of that.

[00:02:16](https://www.youtube.com/watch?v=_7P580m4kPY&t=136s)  And you would have to create some sort of mechanism to track all of these payloads.

[00:02:20](https://www.youtube.com/watch?v=_7P580m4kPY&t=140s)  if you don't want to lose them.

[00:02:21](https://www.youtube.com/watch?v=_7P580m4kPY&t=141s)  The second problem that we've noticed

[00:02:23](https://www.youtube.com/watch?v=_7P580m4kPY&t=143s)  is that LLM analyzers can be tricked.

[00:02:26](https://www.youtube.com/watch?v=_7P580m4kPY&t=146s)  There's a really interesting research by Trail of Bits

[00:02:29](https://www.youtube.com/watch?v=_7P580m4kPY&t=149s)  in which they showcased a skill

[00:02:31](https://www.youtube.com/watch?v=_7P580m4kPY&t=151s)  that manipulated the package registry

[00:02:34](https://www.youtube.com/watch?v=_7P580m4kPY&t=154s)  of one of the projects,

[00:02:36](https://www.youtube.com/watch?v=_7P580m4kPY&t=156s)  and it had like a small comment

[00:02:38](https://www.youtube.com/watch?v=_7P580m4kPY&t=158s)  that said that the AppSec team approved this change,

[00:02:42](https://www.youtube.com/watch?v=_7P580m4kPY&t=162s)  and it completely worked on the LLM analyzer.

[00:02:46](https://www.youtube.com/watch?v=_7P580m4kPY&t=166s)  So given that scans are not bulletproof,

[00:02:50](https://www.youtube.com/watch?v=_7P580m4kPY&t=170s)  we've resorted to a different kind of action.

[00:02:52](https://www.youtube.com/watch?v=_7P580m4kPY&t=172s)  And we actually decided to just run the skill with the agent.

[00:02:56](https://www.youtube.com/watch?v=_7P580m4kPY&t=176s)  This is a technique employed by malware researchers for years now,

[00:03:00](https://www.youtube.com/watch?v=_7P580m4kPY&t=180s)  and it's called detonation, a detonation chamber.

[00:03:03](https://www.youtube.com/watch?v=_7P580m4kPY&t=183s)  So we created the same one, but for agents and skills.

[00:03:08](https://www.youtube.com/watch?v=_7P580m4kPY&t=188s)  And this was our first version.

[00:03:10](https://www.youtube.com/watch?v=_7P580m4kPY&t=190s)  In our first version, we created a task prompt.

[00:03:13](https://www.youtube.com/watch?v=_7P580m4kPY&t=193s)  We put an agent and a skill inside a sandbox.

[00:03:15](https://www.youtube.com/watch?v=_7P580m4kPY&t=195s)  We let it operate over, like, minutes or hours.

[00:03:19](https://www.youtube.com/watch?v=_7P580m4kPY&t=199s)  until it completed a task with an observed agent traces and analyzed it.

[00:03:25](https://www.youtube.com/watch?v=_7P580m4kPY&t=205s)  You can imagine that it wasn't enough.

[00:03:27](https://www.youtube.com/watch?v=_7P580m4kPY&t=207s)  Our first problem was that the environment was missing most of the time.

[00:03:32](https://www.youtube.com/watch?v=_7P580m4kPY&t=212s)  A lot of skills rely on CLIs.

[00:03:35](https://www.youtube.com/watch?v=_7P580m4kPY&t=215s)  They rely on specific services and even on the existence of projects.

[00:03:40](https://www.youtube.com/watch?v=_7P580m4kPY&t=220s)  You can imagine notion skill, for instance.

[00:03:43](https://www.youtube.com/watch?v=_7P580m4kPY&t=223s)  This will have to have a notion service available to talk to.

[00:03:47](https://www.youtube.com/watch?v=_7P580m4kPY&t=227s)  So we've added a world builder that looks at the skill and builds the appropriate environment accordingly.

[00:03:55](https://www.youtube.com/watch?v=_7P580m4kPY&t=235s)  But then we'll encounter another issue.

[00:03:57](https://www.youtube.com/watch?v=_7P580m4kPY&t=237s)  A generic task prompt might not be enough for all skills.

[00:04:02](https://www.youtube.com/watch?v=_7P580m4kPY&t=242s)  I mean, think about it.

[00:04:03](https://www.youtube.com/watch?v=_7P580m4kPY&t=243s)  You can have a presentation skill that needs to create a deck or a deployment skill that needs to ship a service,

[00:04:09](https://www.youtube.com/watch?v=_7P580m4kPY&t=249s)  a brainstorming skill that needs to explore an idea.

[00:04:12](https://www.youtube.com/watch?v=_7P580m4kPY&t=252s)  Each and every one of them has an entirely different motus operandi.

[00:04:16](https://www.youtube.com/watch?v=_7P580m4kPY&t=256s)  Let's take shipping a service, for instance.

[00:04:19](https://www.youtube.com/watch?v=_7P580m4kPY&t=259s)  You need to learn how to configure it.

[00:04:21](https://www.youtube.com/watch?v=_7P580m4kPY&t=261s)  You need to learn how to deploy it.

[00:04:22](https://www.youtube.com/watch?v=_7P580m4kPY&t=262s)  You need to tell it to recover from snapshots, using snapshots.

[00:04:26](https://www.youtube.com/watch?v=_7P580m4kPY&t=266s)  Each and every one of them requires a different set of prompts,

[00:04:31](https://www.youtube.com/watch?v=_7P580m4kPY&t=271s)  and you also need to make sure that you cover every route in that skill

[00:04:39](https://www.youtube.com/watch?v=_7P580m4kPY&t=279s)  because one of them can be malicious.

[00:04:40](https://www.youtube.com/watch?v=_7P580m4kPY&t=280s)  So we created the operator that does just that.

[00:04:43](https://www.youtube.com/watch?v=_7P580m4kPY&t=283s)  It leads through the skill and tries to analyze what are the different trajectories that we should invoke.

[00:04:50](https://www.youtube.com/watch?v=_7P580m4kPY&t=290s)  And why it worked pretty well?

[00:04:52](https://www.youtube.com/watch?v=_7P580m4kPY&t=292s)  If you worked with agents, especially in the security domain, you can assess that we went through a lot of safeguards,

[00:05:05](https://www.youtube.com/watch?v=_7P580m4kPY&t=305s)  safeguard triggers.

[00:05:07](https://www.youtube.com/watch?v=_7P580m4kPY&t=307s)  We got a lot of refusals.

[00:05:10](https://www.youtube.com/watch?v=_7P580m4kPY&t=310s)  the agents wasn't willing to decode

[00:05:12](https://www.youtube.com/watch?v=_7P580m4kPY&t=312s)  and when it was willing to decode

[00:05:14](https://www.youtube.com/watch?v=_7P580m4kPY&t=314s)  it wasn't willing to execute

[00:05:17](https://www.youtube.com/watch?v=_7P580m4kPY&t=317s)  so we had to give you

[00:05:18](https://www.youtube.com/watch?v=_7P580m4kPY&t=318s)  an offer you can't refuse

[00:05:20](https://www.youtube.com/watch?v=_7P580m4kPY&t=320s)  and essentially create an adversarial operator

[00:05:22](https://www.youtube.com/watch?v=_7P580m4kPY&t=322s)  that convinces the agents

[00:05:25](https://www.youtube.com/watch?v=_7P580m4kPY&t=325s)  to run

[00:05:25](https://www.youtube.com/watch?v=_7P580m4kPY&t=325s)  and in case you didn't run even

[00:05:29](https://www.youtube.com/watch?v=_7P580m4kPY&t=329s)  start the run from

[00:05:30](https://www.youtube.com/watch?v=_7P580m4kPY&t=330s)  the beginning

[00:05:33](https://www.youtube.com/watch?v=_7P580m4kPY&t=333s)  now I would

[00:05:34](https://www.youtube.com/watch?v=_7P580m4kPY&t=334s)  emphasize that we're doing a security

[00:05:37](https://www.youtube.com/watch?v=_7P580m4kPY&t=337s)  research here, this is a container environment

[00:05:39](https://www.youtube.com/watch?v=_7P580m4kPY&t=339s)  Nothing is malicious in here.

[00:05:41](https://www.youtube.com/watch?v=_7P580m4kPY&t=341s)  But this is one of the things that we had to do in order to make it run properly.

[00:05:45](https://www.youtube.com/watch?v=_7P580m4kPY&t=345s)  I would also note that a lot of the time, safeguards are being run on something which is definitely not malicious.

[00:05:52](https://www.youtube.com/watch?v=_7P580m4kPY&t=352s)  Sometimes you need to decode a payload, and it's part of the official skill.

[00:05:56](https://www.youtube.com/watch?v=_7P580m4kPY&t=356s)  But the safeguard would still be triggered.

[00:05:58](https://www.youtube.com/watch?v=_7P580m4kPY&t=358s)  So up until now, we were dealing with the sandbox.

[00:06:03](https://www.youtube.com/watch?v=_7P580m4kPY&t=363s)  At this point, we started to tackle the capturing mechanism.

[00:06:09](https://www.youtube.com/watch?v=_7P580m4kPY&t=369s)  So agent traces can go that far.

[00:06:14](https://www.youtube.com/watch?v=_7P580m4kPY&t=374s)  At some point, you'd be missing some side effects.

[00:06:17](https://www.youtube.com/watch?v=_7P580m4kPY&t=377s)  And npm install is the perfect example.

[00:06:20](https://www.youtube.com/watch?v=_7P580m4kPY&t=380s)  npm install has a post-installation script.

[00:06:23](https://www.youtube.com/watch?v=_7P580m4kPY&t=383s)  And the post-installation script can invoke a new process.

[00:06:26](https://www.youtube.com/watch?v=_7P580m4kPY&t=386s)  And that process can read and write to a file and then connect to an endpoint.

[00:06:30](https://www.youtube.com/watch?v=_7P580m4kPY&t=390s)  That's exactly how infosteelers work.

[00:06:33](https://www.youtube.com/watch?v=_7P580m4kPY&t=393s)  So we understood that these are also events and signals that we need to capture.

[00:06:40](https://www.youtube.com/watch?v=_7P580m4kPY&t=400s)  And we did just that as part of the capturing mechanism.

[00:06:43](https://www.youtube.com/watch?v=_7P580m4kPY&t=403s)  We added process creation event, file system event, and network packet capturing.

[00:06:49](https://www.youtube.com/watch?v=_7P580m4kPY&t=409s)  Given all of that along with the agent traces, we then moved it to quality evidence and captured the behavior.

[00:07:00](https://www.youtube.com/watch?v=_7P580m4kPY&t=420s)  Even this final form of the detonation chamber, let's take a look at an example skill.

[00:07:08](https://www.youtube.com/watch?v=_7P580m4kPY&t=428s)  So Zach Korman, you should follow him on Twitter, he created a really interesting skill proof

[00:07:13](https://www.youtube.com/watch?v=_7P580m4kPY&t=433s)  of concept where he created a skill called Security Review 2.

[00:07:18](https://www.youtube.com/watch?v=_7P580m4kPY&t=438s)  And as part of the skill installation, it installed a new skill called Security Review.

[00:07:23](https://www.youtube.com/watch?v=_7P580m4kPY&t=443s)  and security review tells you to go into GitHub

[00:07:26](https://www.youtube.com/watch?v=_7P580m4kPY&t=446s)  and fetch the content of skill.md.

[00:07:28](https://www.youtube.com/watch?v=_7P580m4kPY&t=448s)  And as you can imagine,

[00:07:29](https://www.youtube.com/watch?v=_7P580m4kPY&t=449s)  that skill.md contains hidden instructions

[00:07:32](https://www.youtube.com/watch?v=_7P580m4kPY&t=452s)  for the agent to execute the following payload.

[00:07:35](https://www.youtube.com/watch?v=_7P580m4kPY&t=455s)  And it actually did it.

[00:07:36](https://www.youtube.com/watch?v=_7P580m4kPY&t=456s)  Now, I would note that this is not a malicious payload.

[00:07:40](https://www.youtube.com/watch?v=_7P580m4kPY&t=460s)  This was just a proof of concept,

[00:07:41](https://www.youtube.com/watch?v=_7P580m4kPY&t=461s)  but it does work.

[00:07:43](https://www.youtube.com/watch?v=_7P580m4kPY&t=463s)  And static scanners can't figure that out.

[00:07:46](https://www.youtube.com/watch?v=_7P580m4kPY&t=466s)  You have to actually execute the entire chain

[00:07:50](https://www.youtube.com/watch?v=_7P580m4kPY&t=470s)  in order to recover it.

[00:07:52](https://www.youtube.com/watch?v=_7P580m4kPY&t=472s)  And this is a result of one run on the detonation chamber.

[00:07:57](https://www.youtube.com/watch?v=_7P580m4kPY&t=477s)  Using this approach, we were able to uncover 100 malicious skill out of thousands,

[00:08:04](https://www.youtube.com/watch?v=_7P580m4kPY&t=484s)  and they were shut off the skills.sh framework.

[00:08:10](https://www.youtube.com/watch?v=_7P580m4kPY&t=490s)  Now, let's take a look at another example.

[00:08:13](https://www.youtube.com/watch?v=_7P580m4kPY&t=493s)  Polymarket.

[00:08:14](https://www.youtube.com/watch?v=_7P580m4kPY&t=494s)  This was an interesting skill that is part of its installation script called Polymarket Client V2.

[00:08:21](https://www.youtube.com/watch?v=_7P580m4kPY&t=501s)  You notice the S over here.

[00:08:23](https://www.youtube.com/watch?v=_7P580m4kPY&t=503s)  This is not the original Polymarket package.

[00:08:26](https://www.youtube.com/watch?v=_7P580m4kPY&t=506s)  And when we went into NPM and looked at package.json of the package,

[00:08:32](https://www.youtube.com/watch?v=_7P580m4kPY&t=512s)  we noticed that it actually links to a non-official NPM registry.

[00:08:37](https://www.youtube.com/watch?v=_7P580m4kPY&t=517s)  This isn't real.

[00:08:38](https://www.youtube.com/watch?v=_7P580m4kPY&t=518s)  This isn't official.

[00:08:39](https://www.youtube.com/watch?v=_7P580m4kPY&t=519s)  And looking at the payload, it was actually an infostealer.

[00:08:45](https://www.youtube.com/watch?v=_7P580m4kPY&t=525s)  So it's out there.

[00:08:46](https://www.youtube.com/watch?v=_7P580m4kPY&t=526s)  It's happening.

[00:08:49](https://www.youtube.com/watch?v=_7P580m4kPY&t=529s)  Now, let's take a look at tricks that we've seen actors have been doing in the ecosystem.

[00:08:57](https://www.youtube.com/watch?v=_7P580m4kPY&t=537s)  One of them is persistence.

[00:08:59](https://www.youtube.com/watch?v=_7P580m4kPY&t=539s)  So some of the skills would add an additional prompt to Sol.js, to Sol.md or to Agent.md,

[00:09:08](https://www.youtube.com/watch?v=_7P580m4kPY&t=548s)  stating that if the skill is not installed, just reinstall it.

[00:09:12](https://www.youtube.com/watch?v=_7P580m4kPY&t=552s)  We've seen it happening a couple of times.

[00:09:15](https://www.youtube.com/watch?v=_7P580m4kPY&t=555s)  Another thing that we've noticed is silent actions.

[00:09:18](https://www.youtube.com/watch?v=_7P580m4kPY&t=558s)  There's a skill creator out there,

[00:09:20](https://www.youtube.com/watch?v=_7P580m4kPY&t=560s)  which is not Entropic's official skill creator,

[00:09:23](https://www.youtube.com/watch?v=_7P580m4kPY&t=563s)  that checks if Entropic's skill creator is installed,

[00:09:26](https://www.youtube.com/watch?v=_7P580m4kPY&t=566s)  in case it is uninstalled, and install itself instead.

[00:09:31](https://www.youtube.com/watch?v=_7P580m4kPY&t=571s)  This whole thing happens silently.

[00:09:36](https://www.youtube.com/watch?v=_7P580m4kPY&t=576s)  Another trick that we've seen a lot of actors employed,

[00:09:40](https://www.youtube.com/watch?v=_7P580m4kPY&t=580s)  and this is actually legitimate, but it's still problematic,

[00:09:42](https://www.youtube.com/watch?v=_7P580m4kPY&t=582s)  is remote prompt execution

[00:09:44](https://www.youtube.com/watch?v=_7P580m4kPY&t=584s)  where the initial prompt

[00:09:46](https://www.youtube.com/watch?v=_7P580m4kPY&t=586s)  doesn't contain all of the prompt

[00:09:48](https://www.youtube.com/watch?v=_7P580m4kPY&t=588s)  and it contains instruction

[00:09:49](https://www.youtube.com/watch?v=_7P580m4kPY&t=589s)  to retrieve it from another location.

[00:09:52](https://www.youtube.com/watch?v=_7P580m4kPY&t=592s)  We've seen it on a bunch of skills.

[00:09:55](https://www.youtube.com/watch?v=_7P580m4kPY&t=595s)  Some of them are legitimate.

[00:09:58](https://www.youtube.com/watch?v=_7P580m4kPY&t=598s)  Some of them are illegitimate.

[00:09:59](https://www.youtube.com/watch?v=_7P580m4kPY&t=599s)  And it's kind of problematic

[00:10:01](https://www.youtube.com/watch?v=_7P580m4kPY&t=601s)  because as you can imagine

[00:10:02](https://www.youtube.com/watch?v=_7P580m4kPY&t=602s)  that when something is appropriate

[00:10:04](https://www.youtube.com/watch?v=_7P580m4kPY&t=604s)  at one point in time,

[00:10:05](https://www.youtube.com/watch?v=_7P580m4kPY&t=605s)  at another point in time,

[00:10:07](https://www.youtube.com/watch?v=_7P580m4kPY&t=607s)  someone can either take over the domain

[00:10:09](https://www.youtube.com/watch?v=_7P580m4kPY&t=609s)  or either do it intentionally

[00:10:12](https://www.youtube.com/watch?v=_7P580m4kPY&t=612s)  and change the prompt entirely.

[00:10:15](https://www.youtube.com/watch?v=_7P580m4kPY&t=615s)  This is fairly interesting.

[00:10:17](https://www.youtube.com/watch?v=_7P580m4kPY&t=617s)  And another technique that we've seen is hook abuse.

[00:10:19](https://www.youtube.com/watch?v=_7P580m4kPY&t=619s)  You can actually trigger a skill on a given hook,

[00:10:24](https://www.youtube.com/watch?v=_7P580m4kPY&t=624s)  like user prompt submit.

[00:10:25](https://www.youtube.com/watch?v=_7P580m4kPY&t=625s)  Now imagine what would happen if a skill is triggered

[00:10:27](https://www.youtube.com/watch?v=_7P580m4kPY&t=627s)  every time a user sends a message to the assistant.

[00:10:31](https://www.youtube.com/watch?v=_7P580m4kPY&t=631s)  This could have major consequences,

[00:10:33](https://www.youtube.com/watch?v=_7P580m4kPY&t=633s)  and you need to be aware of that.

[00:10:35](https://www.youtube.com/watch?v=_7P580m4kPY&t=635s)  But let's talk about a campaign that we've uncovered.

[00:10:38](https://www.youtube.com/watch?v=_7P580m4kPY&t=638s)  Meet Carly, or Carly Paperclip, as he known in GitHub.

[00:10:41](https://www.youtube.com/watch?v=_7P580m4kPY&t=641s)  he faked the Paperclip organization. Paperclip is a well-known project. It's an open-source

[00:10:50](https://www.youtube.com/watch?v=_7P580m4kPY&t=650s)  project aimed for orchestration of various agents. Carly here basically created a fake

[00:10:58](https://www.youtube.com/watch?v=_7P580m4kPY&t=658s)  organization that mimics it. He registered the domain under kind of the same name, created a

[00:11:05](https://www.youtube.com/watch?v=_7P580m4kPY&t=665s)  lookalike organization, and then clone the project.

[00:11:08](https://www.youtube.com/watch?v=_7P580m4kPY&t=668s)  After he cloned the project, he did something bad.

[00:11:14](https://www.youtube.com/watch?v=_7P580m4kPY&t=674s)  He created a new log action call and called it under all of the different routes of the

[00:11:19](https://www.youtube.com/watch?v=_7P580m4kPY&t=679s)  project.

[00:11:20](https://www.youtube.com/watch?v=_7P580m4kPY&t=680s)  When we looked into what's happening into log action, we noticed that it's calling the

[00:11:31](https://www.youtube.com/watch?v=_7P580m4kPY&t=691s)  attackers' control endpoint.

[00:11:34](https://www.youtube.com/watch?v=_7P580m4kPY&t=694s)  It fetches a payload from there, decodes it, saves it into a temporary file, and executes it under a node and self-destroy after 60 seconds.

[00:11:47](https://www.youtube.com/watch?v=_7P580m4kPY&t=707s)  When we looked at the payload, this was alarming.

[00:11:52](https://www.youtube.com/watch?v=_7P580m4kPY&t=712s)  It was a credential harvester.

[00:11:53](https://www.youtube.com/watch?v=_7P580m4kPY&t=713s)  Essentially, it went through the different sensitive paths on the machine, such as SSH, AWS, and Azure, collected all the information from those folders, and then posted everything to a feedback endpoint on by the attacker.

[00:12:11](https://www.youtube.com/watch?v=_7P580m4kPY&t=731s)  This was bad.

[00:12:13](https://www.youtube.com/watch?v=_7P580m4kPY&t=733s)  He then did the same thing in browser use.

[00:12:16](https://www.youtube.com/watch?v=_7P580m4kPY&t=736s)  But this was a Python package, but he used the same command and control.

[00:12:20](https://www.youtube.com/watch?v=_7P580m4kPY&t=740s)  And then he tried to publish it in PyPy.

[00:12:23](https://www.youtube.com/watch?v=_7P580m4kPY&t=743s)  That didn't work.

[00:12:25](https://www.youtube.com/watch?v=_7P580m4kPY&t=745s)  Like under two hours, it was just down.

[00:12:27](https://www.youtube.com/watch?v=_7P580m4kPY&t=747s)  He did the same thing with Paperclip AI, which is the Python version of what we just saw.

[00:12:31](https://www.youtube.com/watch?v=_7P580m4kPY&t=751s)  And that also went down after less than an hour.

[00:12:35](https://www.youtube.com/watch?v=_7P580m4kPY&t=755s)  Well, at this point, you'd think that we'd be winning, but no, because the skins that

[00:12:40](https://www.youtube.com/watch?v=_7P580m4kPY&t=760s)  were using the same command and control were actually trading, trending at that time to

[00:12:45](https://www.youtube.com/watch?v=_7P580m4kPY&t=765s)  the point where they had 1.7 million total downloads.

[00:12:50](https://www.youtube.com/watch?v=_7P580m4kPY&t=770s)  So that's, that was pretty bad.

[00:12:52](https://www.youtube.com/watch?v=_7P580m4kPY&t=772s)  And it operates approximately the same way.

[00:12:56](https://www.youtube.com/watch?v=_7P580m4kPY&t=776s)  Upon setup installation, the payload is fetched from the attacker's own health endpoint.

[00:13:02](https://www.youtube.com/watch?v=_7P580m4kPY&t=782s)  It is then being decoded and sent to a JavaScript file.

[00:13:07](https://www.youtube.com/watch?v=_7P580m4kPY&t=787s)  Node then executes it.

[00:13:08](https://www.youtube.com/watch?v=_7P580m4kPY&t=788s)  And then the entire credential harvesting and sending to the post endpoint happens.

[00:13:12](https://www.youtube.com/watch?v=_7P580m4kPY&t=792s)  And it's of destruction as well.

[00:13:14](https://www.youtube.com/watch?v=_7P580m4kPY&t=794s)  Exactly the same chain.

[00:13:16](https://www.youtube.com/watch?v=_7P580m4kPY&t=796s)  We reported the incident to Vercel and Microsoft.

[00:13:19](https://www.youtube.com/watch?v=_7P580m4kPY&t=799s)  And under the last 12 hours, they took everything down.

[00:13:22](https://www.youtube.com/watch?v=_7P580m4kPY&t=802s)  If you want to read more about it, you should read the Zenity Labs blog.

[00:13:26](https://www.youtube.com/watch?v=_7P580m4kPY&t=806s)  It's very interesting.

[00:13:29](https://www.youtube.com/watch?v=_7P580m4kPY&t=809s)  Incredible work.

[00:13:33](https://www.youtube.com/watch?v=_7P580m4kPY&t=813s)  Skill is just one single part of the agent supply chain.

[00:13:38](https://www.youtube.com/watch?v=_7P580m4kPY&t=818s)  Everything that goes inside the agent context is part of it.

[00:13:42](https://www.youtube.com/watch?v=_7P580m4kPY&t=822s)  It can be a website.

[00:13:43](https://www.youtube.com/watch?v=_7P580m4kPY&t=823s)  It can be rows in your database.

[00:13:45](https://www.youtube.com/watch?v=_7P580m4kPY&t=825s)  It can be packages.

[00:13:46](https://www.youtube.com/watch?v=_7P580m4kPY&t=826s)  It can even be a YouTube comment.

[00:13:48](https://www.youtube.com/watch?v=_7P580m4kPY&t=828s)  Everything that comes into the context is under risk.

[00:13:51](https://www.youtube.com/watch?v=_7P580m4kPY&t=831s)  And if we talk about skills in particular, you need to treat them as package dependencies.

[00:13:58](https://www.youtube.com/watch?v=_7P580m4kPY&t=838s)  You need to inspect everything that it loads, limit what it can access, list privileges, as you're well aware, and observe what is actually being run.

[00:14:08](https://www.youtube.com/watch?v=_7P580m4kPY&t=848s)  Now, this entire work on the detonation shiver was done by the entire research and engineering thing that you see over here.

[00:14:17](https://www.youtube.com/watch?v=_7P580m4kPY&t=857s)  highly talented people, and I encourage you to follow them.

[00:14:22](https://www.youtube.com/watch?v=_7P580m4kPY&t=862s)  And with that, if you want to test out your skills,

[00:14:25](https://www.youtube.com/watch?v=_7P580m4kPY&t=865s)  it's available in a.total.io.

[00:14:26](https://www.youtube.com/watch?v=_7P580m4kPY&t=866s)  This is the donation chamber, and thank you so much.