skills.sh

Reported Context (2)

In addition to its PleaseFix research, AI security company Zenity detailed an active malicious skills campaign distributed through Vercel’s skills.sh. Black Hat USA 2026: Vendors Announce Security Products and Research
The experiment showed that scanners from Cisco, NVIDIA, and skills.sh missed the threat because the malicious logic lived behind an external link that could be changed after review. AIR Says Fake AI Agent Skill Reached 26,000 Agents After Evading Scanners

CVE (2)

People (1)

Vendors (18)

Products (20)

Industries (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.