Skill Poisioning turning AI agents into malware droppers - warns China's National CERT

Security teams in China identified skill poisoning trend where, attackers publish a fake “skill”, a plug-in that an AI agent is supposed to load so it can book travel, write code, or run tools. Once the agent installs it, hidden instructions tell the software to download malware in the background. The user never has to click a suspicious link. The agent does the dirty work.

China’s National Computer Virus Emergency Response Center (CVERC) and the National Engineering Laboratory for Computer Virus Prevention first reported the campaign in April 2026. They found counterfeit skill packs in repositories used by an agent system they call “Lobster” (龙虾), also referred to in technical notes as OpenClaw. By early September the same case was back in official briefings, because the national cyberspace threat report and Cybersecurity Awareness Week talking points now treat agent plug-ins as a live attack path, not a lab curiosity.

What is Skill Poisoning Attack?

Analysts using the National Computer Virus Collaborative Analysis Platform found eight fake skill packs. On the surface they looked like normal add-ons. Inside, they carried malicious prompt text, instructions the agent would follow when the skill was loaded or used.

When those skills ran, the agent silently fetched a trojan. CVERC said the malware could:

• steal files and other data from the local computer
• let an attacker take remote control
• use the machine as a jump box into a company network or other devices

Du Zhenhua, a senior engineer at CVERC, said ordinary users cannot easily tell a safe skill from a poisoned one. There is no familiar “this file looks like a virus” moment. The danger is wrapped in natural-language instructions and a helpful-looking plug-in name.

Officials now describe a six-month slide: first poisoned skills, then agents that help write malware, then agents that can start attacks with little human steering. That last step matches other 2026 reporting on AI-driven attack loops against internet-facing servers.

Why this is different from old malware

Classic malware needs someone to open an attachment or run an installer. An AI agent is built to do things: fetch URLs, run scripts, call tools, touch files.

A poisoned skill abuses that design.

Think of it as a bad recipe card. You ask the cook to “summarise this folder.” The recipe also says “download this extra program and run it.” The cook follows both lines because that is what agents do.

Three features make the risk worse:

1. Skills are easy to share. Repos and marketplaces spread them the way browser extensions or npm packages once did.
2. Prompts are hard to audit. Malicious text can sit next to legitimate instructions.
3. Agents often hold high privileges. Some terminal agents can run system commands. If the skill is hostile, those rights become the attacker’s rights. CAC officials listed that exact problem among five AI security risks ahead of National Cybersecurity Awareness Week (14–20 September 2026).

Skill packs have become a new virus delivery channel. The target is no longer only the user’s inbox. It is the data the agent can see and the systems the agent can operate.

IOCs, poisoned skill packs (CVERC)

Pattern in the national list: the lures are everyday agent jobs, social accounts, research, spreadsheets, prediction markets, a crypto wallet, and a headless browser. Those skills need tokens, files and network access. That is why they are valuable to steal.

Security Recommendations while using a Skill File

• Before installing the skills package, perform a security audit of the prompts included in the skills package, external network links, scripted code, tool software called, etc. to ensure that it matches the function description and does not contain the code with unknown features.
• Use only the official project or vendor channel.
• Read the whole skill: prompts, URLs, scripts, tools. Delete it if it fetches a file you did not ask for.
• Prefer skills that cannot run a shell or talk to a wallet.

While the agent runs

• Do not give one agent the whole disk, password store, or production network.
• Sandbox it. “Read this folder” is not “install software.”
• Allow-list outbound downloads.
• Log every tool call. A sudden unknown domain is the alert.