VirusTotal Exposes 6,637 AI Agent Skills as Malicious, Many Hiding Plain-Language Attack Instructions

VirusTotal researchers analyzing 35,878 AI agent skills discovered that 6,637 (18.5%) are malicious, with a striking 62% containing no actual executable code—instead embedding attack instructions as plain text within skill documentation that agents read but humans may overlook. The analysis, part of the security firm's "From Automation to Infection" research series, reveals how AI agent skills have become a new supply-chain vector for malware deployment.