AI Agent Skill Marketplaces: Emerging Supply‑Chain Attack Vector

Third‑party AI agent skills published to marketplaces such as Hugging Face, Azure AI Skills, and AWS Marketplace constitute an unvetted supply‑chain component. Analysis of 3,014 skill cases revealed 233 malicious skills embedding indirect prompt injection, tool misuse, and model decision manipulation, with 42.5% of successful compromises only observable after an initial benign interaction. The SkillAtlas framework catalogued 6,589 attack traces totaling 151,131 execution steps, enabling detection rules that raise pre‑execution guard accuracy to 0.770. Unchecked skill ingestion can lead to financial loss (e.g., a $50,000 cloud bill) and rapid market growth (>200% YoY).

• Threat Model & Attack Surface:
• Attack vectors: indirect prompt injection, tool misuse, model decision manipulation.
• Derived from SkillAtlas traces across 8 risk categories covering model, tool, and feedback stages.

• 42.5% of successful compromises manifest only after an initial benign interaction (delayed success).

• Skill Inventory & Vulnerability Findings:

• 3,014 skills inventoried from Hugging Face, Azure AI Skills, AWS Marketplace.
• 233 skills (≈7.7%) classified as malicious, contributing 6,589 traces and 151,131 execution steps.

• Marketplace submissions grew >200% YoY (2023‑2025), outpacing vetting capabilities.

• Detection & Vetting Pipeline:

• Static analysis + dependency scanning + sandboxed execution with syscall tracing.
• Behavior‑based ML detectors trained on SkillAtlas yield pre‑execution guard accuracy 0.770.

• Sigma/YARA ruleset flags anomalous tool calls and prompt patterns in runtime telemetry.

• Impact & Financial Risk:

• Compromised skills can trigger uncontrolled resource consumption (e.g., $50k cloud bill).
• Indirect prompt injection enables data exfiltration or privilege escalation via trusted agent workflows.

• Supply‑chain nature amplifies blast radius: a single malicious skill affects all downstream agents.

• Enterprise Guidance & Conclusion:

• Implement skill‑approval workflows: provenance checks, version pinning, and sandboxed validation before deployment.
• Deploy runtime monitoring using the provided detection ruleset and alert on delayed‑success patterns.
• Maintain an incident‑response playbook isolating the skill, revoking tokens, and forensic analysis of SkillAtlas‑linked IoCs.