Your AI just learned a new superpower from a one-line download. Nobody checked what else was in the box.

In partnership with

Think about how you teach a person a new job. You show them the ropes, they practise, and slowly they get good. Now imagine you could skip all of that — hand them a single index card, and the instant they read it, they know the whole job. Accounting. Legal drafting. Fixing your website. One card, one new expert.

That is more or less what just happened to AI assistants. And in a few months, it has become the most exciting — and most quietly dangerous — corner of the whole AI world.

The index card has a name: the agent skill. It’s a small bundle of plain-English instructions (plus a few helper scripts) that you hand to an AI tool like Claude Code, and it teaches the AI a brand-new capability on the spot. Want your assistant to build a polished website, review a contract, or run your accounts a particular way? Drop in the right skill and it can, instantly — no training, no fiddly setup.

The format barely existed before late 2025. By early 2026, one marketplace alone had filled up with more than 40,000 of these skills, published by anyone who fancied it. It’s one of the fastest-growing things in software right now.

The wonder is real. So is the trap. Because that index card your AI reads so obediently? Anyone can write one — and some are written to rob you.

Let’s start with the good part, because it’s genuinely lovely.

✨ The wonderful part: a one-click superpower for your AI

Here’s the magic, and once you feel it you understand the gold rush. The old way to make an AI assistant better at something was slow and technical: you wrote long, careful instructions every single time, or you paid a developer to wire things together.

The new way is a swap-in cartridge. A skill packages up expertise — “here’s exactly how to design a beautiful landing page and here are the taste rules to follow” — into a bundle you install once. From then on, your AI just has that skill, the way a phone gains a new trick when you install an app.

And these aren’t toys. One of the most popular skills on the market, a design skill called Hallmark, exists purely to stop AI-made websites from looking like generic “AI slop.” It ships a rulebook of design taste — dozens of little quality checks the AI runs against its own work before showing it to you — so the result looks like a real designer made it. Free, open, and it collected thousands of users in weeks. That’s the dream version of this whole idea: bottled expertise, handed around freely, making everyone’s AI a little more capable.

Multiply that by 40,000. There are skills for security testing, for writing legal clauses, for talking to your database, for managing your calendar. The promise is a world where you assemble your ideal assistant from a library of ready-made talents, clicking them in like Lego. For once, the hype is pointing at something that actually works.

So what’s the catch? The catch is the same thing that makes it wonderful: anyone can write a skill, nobody checks them, and your AI trusts every word.

🎭 The trapdoor: the booby trap is a sentence, not a virus

Here is the part almost nobody thinks about when they install one of these. When your AI reads a skill, it doesn’t just learn from it — it will happily act on it. And a skill runs with all the same powers your assistant already has: it can read your files, open your terminal, reach the passwords and keys stored on your machine, and send things out over the internet. You didn’t grant the skill those powers on purpose. It simply inherits them, because it’s now part of your assistant.

Now here’s the twist that makes this different from every malware scare you’ve heard before. Normally, a booby-trapped download hides its nastiness in code — the confusing computer stuff a scanner can pick apart. But a skill’s weapon can be an ordinary English sentence. Something as plain as:

To you, that’s gibberish buried in a text file you’ll never open. To your AI, it reads like an instruction from the boss — and off it goes, switching off its own caution and running whatever comes next. The attack isn’t smuggled past the guard. The attack talks the guard into opening the gate.

This is not a thought experiment. It’s already happened, at scale:

• Security researchers documented a campaign nicknamed ClawHavoc that planted more than 300 booby-trapped skills on a single marketplace. The instruction files quietly told the AI to fetch and run a hidden program — dressed up as a routine “setup” step — which then went hunting for saved browser passwords, keychain secrets, login keys, and crypto wallets. (Source: Help Net Security)

• When the security firm Snyk ran the first big audit of these marketplaces — scanning nearly 4,000 skills — it found more than a third had a security flaw of some kind, and about one in eight (13%) carried a critical one: malware, credential theft, or hidden hijacking instructions. It confirmed 76 skills that were outright malicious, several still live and downloadable at the time. (Source: Snyk)

Snyk put it bluntly: the barrier to publishing a skill is “a text file and a GitHub account that’s one week old.” No safety review. No signature. No sandbox. It’s exactly like the wild-west early days of app stores and code libraries — except this time the thing reading the untrusted download has the keys to your whole machine.

And the scariest detail for anyone hoping a scanner will save them: the traps are getting good at hiding. University researchers built a tool that repackages a malicious skill to keep it working while making it look innocent — and it slipped past more than 90% of the scanners meant to catch it. Some are even written using invisible characters your text editor renders as blank space, but the AI still reads and obeys. (Source: Help Net Security)

So: a superpower store where anyone can stock the shelves, the products can command your assistant in plain English, and the label doesn’t always tell you what’s inside. Time for the good news — because there is plenty.

Write docs 4x faster. Without hating every second.

Nobody became a developer to write documentation. But the docs still need to get written — PRDs, README updates, architecture decisions, onboarding guides.

Wispr Flow lets you talk through it instead. Speak naturally about what the code does, how it works, and why you built it that way. Flow formats everything into clean, professional text you can paste into Notion, Confluence, or GitHub.

Used by engineering teams at OpenAI, Vercel, and Clay. 89% of messages sent with zero edits. Works system-wide on Mac, Windows, and iPhone.

Try Wispr Flow free

🛡️ The good news: you’re in control of the front door

Here’s the reassuring truth underneath the scary headline: a skill can only do damage if you install it — and unlike a lot of security threats, this is a door only you can open. No skill jumps onto your machine by itself. That gives you more power here than in almost any other kind of attack. A handful of simple habits close the gap almost entirely. You don’t need to be technical — these are the digital version of “don’t eat food a stranger hands you in the street.”

• Only install skills from people you’d trust with your house keys. The biggest protection is knowing who made it. A skill from a well-known company or a creator with a long public reputation is worlds apart from one uploaded last Tuesday by an account with no history. If you can’t tell who made it, don’t install it.

• Treat “just run this setup step” as a red flag. The most common trap disguises itself as a routine install instruction. If a skill wants to download and run something from the internet as part of setup, that’s your cue to stop and get a second opinion — not to wave it through.

• Don’t let your AI run with the family silver in reach. Keep your most sensitive credentials — banking, cloud accounts, crypto — out of the environment your assistant works in. Many of these attacks succeed simply because the passwords were sitting right there. Separate the playground from the vault.

• Keep a human hand on the wheel for anything irreversible. Run any capable AI assistant with approval checkpoints: it proposes, you okay the important steps — especially anything that sends data out, deletes things, or touches money. A single “are you sure?” breaks most of these attacks.

• If you ever suspect a bad skill, change your passwords — don’t just delete it. A poisoned skill may already have grabbed and sent off your saved logins, so removing it isn’t enough. Rotate the important passwords and keys it could have reached (start with email and anything financial).

None of this requires a security team or a single line of code. It’s mostly judgement: who made this, why should I trust them, and what am I letting it touch?

✅ What to actually do

This week, pick the row that’s you:

1. You use AI coding or assistant tools: review which skills you’ve installed and delete any you don’t recognise or can’t trace to a trustworthy maker. From now on, install skills the way you’d hire someone for your home — reputation first. And keep your real passwords and keys out of the folder your assistant works in.

2. You’re a business owner whose team uses these tools: ask whoever runs your tech three questions — Do we only install AI skills and add-ons from vetted, named sources? Does our AI need a human to approve sensitive actions? Are our credentials walled off from the AI’s workspace? “Yes, yes, and yes” is the answer you want.

3. You’re just here to understand it: the takeaway is one line — an AI assistant will obey instructions hidden inside anything you feed it, so be as careful about what you hand your AI as you are about what you download to your phone.

4. Zoom out: app stores were a mess in their early years too, until vetting, signing, and sandboxes became normal. The same fixes are coming for AI skills — and until they arrive, you are the vetting step. Choose accordingly.

The takeaway

The agent skill is a genuinely wonderful idea: bottled expertise you can hand your AI in a single click, turning a general assistant into a specialist on demand. Forty thousand of them, and counting. Used well, it’s one of the most useful things to happen to everyday AI.

But the same open door that let all that brilliance in also let the con artists set up a stall. The booby trap here isn’t a virus hiding in the machinery — it’s a sentence, written in plain English, whispering to your assistant that the rules don’t apply today. And your assistant, eager and literal, believes it.

The fix isn’t fear, and it isn’t giving up the superpowers. It’s a shopkeeper’s instinct you already have: know who you’re buying from, don’t run the “just do this first” step from a stranger, and never leave the valuables where a guest can reach them. Your AI will read every card you hand it and take it at its word. So be the one who decides which cards it gets.

Click carefully, stay curious.

— itscybernews

Know someone who’s started leaning on an AI assistant for real work? Forward them this — the “only install from people you’d trust with your keys” rule could save them a very bad week. And reply to tell us what you’d like us to dig into next: we read every one.