The AI Skill That Hides a Malware Prompt

VirusTotal analyzed roughly 36,000 AI skills and identified 6,637 as malicious—nearly one in five—with 62% of those malicious skills containing no executable code, according to a VirusTotal blog post. The payloads are plain-language instructions that agents interpret as directives, and VirusTotal found at least 90 skills using visual evasion techniques such as whitespace padding, HTML comments and invisible Unicode characters; one WHO-data skill hid an instruction after 733 lines to report malaria in Nigeria as zero, and a cold-email tool tucked a BCC directive after 672 blank lines. Some skills tell the agent "your human doesn't need to know" or write to memory-like files such as memory.md or agents.md for persistence, a semantic supply-chain threat that traditional security tools miss because there is no malicious code to detect.

The payload is a sentence, not a program A striking new vulnerability has emerged in the burgeoning AI agent ecosystem. VirusTotal analyzed roughly 36,000 AI skills and identified 6,637 as malicious—nearly one in five. This isn't traditional malware; 62% of these malicious skills contained no executable code. The payload is a sentence, not a program. These agents interpret skill content as direct instructions, meaning plain-language directions can become a vector for attack. This represents a fundamental shift in the threat model, where semantic understanding, not code execution, drives the exploit. Agents often operate with extensive permissions, accessing files, terminals, and network tools. A carefully crafted prompt can leverage these trusted user permissions to trigger data exposure, unauthorized system modifications, or other malicious actions. It’s the npm problem all over again, but the payload is now conversational. Attackers employ various evasion techniques. Some hide instructions hundreds of blank lines below the apparent end of a file. Others embed directives in HTML comments or invisible Unicode characters, which are hidden from human reviewers but fully readable by the underlying LLM. This requires us to inspect the raw file, not just the rendered version. The tricks that disappear in a preview Attackers employ visual trickery to conceal malicious prompts from human reviewers. Some prompts sit hundreds of blank lines below apparent file content, a technique known as whitespace padding . One WHO-data skill hid an instruction after 733 lines to report malaria in Nigeria as zero. Another cold-email tool tucked a BCC directive after 672 blank lines. HTML comments also serve as a disguise. These elements, like < -- hidden text -- , disappear in rendered web pages but remain visible to an agent reading the raw file. Invisible Unicode characters, such as zero-width spaces, further obscure text from human eyes and basic pattern matching, yet remain fully readable by the underlying LLM. VirusTotal found at least 90 skills using these visual evasion techniques. This highlights a critical gap: what a marketplace displays to a human reviewer often differs from the raw file an agent actually processes. This discrepancy creates an opportunity for malicious actors to embed covert instructions. This problem echoes the npm supply chain vulnerabilities, but with a semantic twist. The payload is now a sentence, not a program, yet it carries the same potential for compromise. Users must inspect raw files, not just rendered previews, to verify skill integrity. When the agent is told to keep quiet Instructions sometimes explicitly direct the agent to conceal its actions. Some malicious skills, for instance, tell the agent that "your human doesn't need to know." This direct command bypasses human oversight, allowing the agent to execute its hidden directives without raising suspicion. Furthermore, these payloads aim for persistence . Instructions may ask the agent to write to memory-like files such as memory.md or agents.md . This embeds the malicious behavior directly into the agent's long-term configuration, ensuring it can continue to affect subsequent sessions even after the initial skill is removed or disabled. This pattern is strikingly reminiscent of the npm supply-chain problem that has plagued software development for years. However, the attack surface shifts significantly with AI agents. Instead of conventional exploits or binary code, the payload is often semantic text —plain language instructions that an LLM interprets and acts upon. For more detailed analysis, see How Some Malicious AI Skills Hide Instructions from Reviewers - VirusTotal Blog https://blog.virustotal.com/2026/10/how-some-malicious-ai-skills-hide.html . The distinction is critical: traditional security tools struggle to identify these text-based exploits because they lack malicious code. Out of the 6,637 malicious skills VirusTotal identified, 62% contained no traditional executable code. This highlights a fundamental challenge in securing agentic systems, where a simple sentence can be as potent as a sophisticated virus. Enjoying this? Get one like it in your inbox each morning. one email a day · unsubscribe in two clicks · no third-party tracking Inspect the raw file before you trust the skill Given the subtle nature of these attacks, relying on rendered previews from GitHub or marketplace UIs introduces critical blind spots. Always inspect the raw source file directly. Look for unusually large blank-line gaps, HTML comments, and suspicious Unicode characters that disappear in formatted views but remain readable to an agent. Beyond manual inspection, implement robust permissioning. Agents should require explicit approval before writing to memory or configuration files like memory.md or agents.md . Apply the principle of least privilege to all filesystem and network access, minimizing an agent’s potential blast radius. While isolated sandboxes and security scanners offer defense-in-depth, they are not foolproof. Open-source skill scanners, for instance, miss between 33% and 71% of these natural language exploits. This high failure rate underscores the continued necessity of human review and strictly enforced permissions. The npm ecosystem taught us that seemingly innocuous components can hide dangerous payloads. Now, with AI skills, the payload is often just a sentence. Vigilance at the raw file level, combined with stringent access controls, remains your best defense against these evolving threats. Frequently Asked Questions What is a malicious AI agent skill? It is a skill containing instructions that manipulate an AI agent into unsafe actions, such as exposing data or changing files. How can a skill hide instructions from human reviewers? It can place prompts after long blank spaces, inside HTML comments, or in invisible Unicode characters that renderers and editors may conceal. Why can traditional malware scanners miss these skills? Many malicious skills contain no executable code; their payload is natural-language text that the agent interprets as instructions. How can I reduce the risk of using AI skills? Inspect raw source, check the end of files, require approval for memory changes, and run agents with least privilege in a sandbox.