Trail of Bits reports malicious agent skills bypass marketplace scanners

What was reported

Trail of Bits reported that malicious skills distributed through public agent-skill marketplaces can steal credentials, exfiltrate data, and hijack agents. The firm says it bypassed several skill scanners using test skills, highlighting risks in current distribution and detection systems.

Why it matters

Users may install harmful skills believing marketplace scanners provide adequate protection, exposing credentials, data, and agent controls.

Evidence and limitations

• The source describes malicious skills and scanner bypasses affecting agent-skill marketplaces.
• No supported blockchain is identified in the source; the chain fields are included only because the report schema requires at least one supported chain.

Rug.Tools has not independently verified the publisher's incident claims. Reported allegations remain attributed to Trail of Bits; they are not presented as deterministic Rug.Tools findings.