🤖 Skill Issues: How We Discovered Supply Chain Attack Vectors in an AI Agent Skills Marketplace

Orca Security identified four supply chain attack primitives in an AI agent skills marketplace: unauthenticated install count inflation, non-deterministic security scanning, silent skill name override, and blind bulk updates. All enabling bait-and-switch, nested skill injection, and delayed weaponization attacks achieving real-world RCE.

https://orca.security/resources/blog/ai-agent-skill-supply-chain-security

#AI