Can an AI agent "skill" actually be malware?

The question

The timing made this one worth answering carefully. The same week this came in, China's national CERT disclosed that it had found fake AI-agent "skill" plugins acting as malware droppers — the payload activated the moment the skill loaded, with no click required. Separately, the same week, a wave of malicious packages disguised as automation tooling was published to a public code registry, aimed at stealing API keys from anyone who installed them.

What we told them

Yes — and the risk is real for a specific reason: most people don't apply the same scrutiny to a "skill" that they'd apply to installing software, even though it's the same trust decision. A browser extension asks for permissions and most people at least glance at the prompt. An AI-agent skill often installs with a single click from a chat window, and "it's just extending the AI" doesn't feel like installing anything at all.

But a skill is code that runs with access to your AI agent's context — which, depending on what you've connected the agent to, can mean your inbox, your files, your CRM, or your accounts. The CERT case is the sharpest example: the malicious skills didn't wait for the user to run a command or click a link. Loading the skill was enough to drop the payload. That's a different threat model than "don't click suspicious links" — it's "don't add unvetted extensions," full stop.

This isn't limited to one platform, either. The same news cycle had a separate incident of malicious automation packages published to a mainstream code registry — different ecosystem, same underlying problem: whenever it becomes easy for anyone to publish something that plugs into a popular tool, some of what gets published will be hostile, and the marketplace itself won't always catch it before people install it.

Three things we'd put in place before letting anyone add a skill: only install from a marketplace that actually reviews submissions, not a raw link pasted into a chat; check what the skill is asking to access before installing — a "note summarizer" that wants network or file-system access is a red flag regardless of its reviews; and treat AI-agent extensions like any other piece of installed software — an approved list someone maintains, not a free-for-all where anyone on the team adds whatever looks useful.