Skill Poisioning turning AI agents into malware droppers - warns China's National CERT

Summary

China's National Computer Virus Emergency Response Center (CVERC) has warned of a technique it calls 'skill poisoning,' in which attackers publish counterfeit AI-agent 'skills' (plug-ins) that carry hidden malicious prompt instructions. When an AI agent loads or uses the poisoned skill, it silently downloads a trojan in the background without the user clicking anything.^[1]

CVERC and the National Engineering Laboratory for Computer Virus Prevention first reported the activity in April 2026, identifying eight fake skill packs in repositories used by an agent system referred to as 'Lobster' (龙虾) / OpenClaw. The delivered malware can steal local files, grant remote control, and pivot into a wider network. The case reappeared in official briefings by early September 2026, ahead of National Cybersecurity Awareness Week.^[1]

All details in this dossier derive from a single aggregator article that attributes its content to CVERC and explicitly states it is not an official government portal, so claims should be treated as single-source pending corroboration.^[1]

Attack chain

1. Delivery / staging: Attackers publish fake 'skills' — plug-ins an AI agent is meant to load — in repositories and marketplaces, disguised as everyday utilities (social accounts, research, spreadsheets, prediction markets, crypto wallet, headless browser).^[1]
2. Execution via poisoned prompt: The skill contains hidden natural-language instructions embedded alongside legitimate ones. When the agent loads or runs the skill, it follows the malicious instructions and fetches a trojan in the background, without the user clicking a link.^[1]
3. Payload / impact: The downloaded trojan can steal files and local data, let an attacker take remote control, and use the compromised machine as a jump box into a company network or other devices.^[1]

Disclosure timeline

How it works

The technique abuses the fundamental design of AI agents, which are built to fetch URLs, run scripts, call tools, and touch files. A poisoned skill inserts malicious instructions in natural-language prompt text that sits next to legitimate instructions; the agent executes both because that is how agents operate. Because prompts are hard to audit and there is no obvious 'this file is a virus' moment, users cannot easily distinguish a safe skill from a poisoned one.^[1]

Risk is amplified because skills are easy to share via repos and marketplaces (like browser extensions or npm packages once were) and because agents often hold high privileges — some terminal agents can run system commands, so a hostile skill inherits those rights.^[1]

Affected versions and patch status

Indicators of Compromise

Key takeaways

• Skill poisoning weaponizes the intended behavior of AI agents — fetching URLs, running scripts, and executing tools — making poisoned plug-ins a stealthy malware delivery channel that requires no user click.^[1]
• CVERC documented eight concrete poisoned skill packs with file names and hashes, giving defenders immediate hunt/block indicators, and warned of an escalation trend from poisoned skills toward increasingly autonomous AI-driven attacks.^[1]
• All information stems from a single aggregator attributing to CVERC; corroboration from primary CVERC publications is advisable before treating the details as fully confirmed.^[1]

Defensive actions

• Perform a security audit of a skill package before installation — review included prompts, external network links, scripted code, and called tool software to ensure they match the function description and contain no unknown-feature code.: Malicious instructions are hidden in natural-language prompt text alongside legitimate ones and cannot be spotted by ordinary users; auditing is the only way to catch a fetch you did not ask for.^[1]
• Install skills only from the official project or vendor channel and delete any skill that fetches a file you did not request.: Skill packs have become a new virus delivery channel spread through repos and marketplaces, mirroring past extension/npm abuse.^[1]
• Limit agent privileges — do not give an agent the whole disk, password store, or production network; sandbox it, allow-list outbound downloads, and log every tool call.: Agents often hold high privileges and can run system commands, so a hostile skill inherits those rights; a sudden unknown outbound domain in tool-call logs is the alert.^[1]
• Prefer skills that cannot run a shell or talk to a crypto wallet.: The poisoned skills targeted tokens, files, and network access; skills needing such capabilities are the most valuable to weaponize.^[1]