Fake AI Agent Skill Passed Security Scans and Reportedly Reached 26,000 Agents

AIR built a fake AI agent skill that inherited marketplace trust signals and passed several skill scanners by pointing installers to external documentation it controlled; after the skill was widely installed the external page was swapped to deliver a script (in the demo it only exfiltrated email addresses). The experiment shows a structural weakness in skill vetting—scanners inspect a snapshot but external URLs can be rewritten post-approval—allowing attackers to manipulate trust signals and potentially achieve broad, high-impact access if weaponized, though the scale and full impact claims are unverified.