AI Skills Are Hiding Instructions From You #virustotal #aiagents #cybersecurity
Read the Portuguese translation →
Author: Better Stack · Watch on YouTube
Video authored by the channel shown, not by IANIA; all rights belong to the creator. Transcript and summary generated automatically; the original-language content is preserved.
Original language: English
Original video: AI Skills Are Hiding Instructions From You #virustotal #aiagents #cybersecurity · Channel: Better Stack · 01:33 · Watch on YouTube
Topics: AI agents, Cybersecurity and software security, Open source and software ecosystems, AI safety
Summary
Section titled “Summary”VirusTotal analyzed 36,000 AI skills and found 6,637 malicious ones, nearly one in five; 62% contained no malicious code and instead relied on plain-English instructions. Some skills hide those instructions using blank space, HTML comments, or invisible Unicode characters that agents can read even when users may not see them. A small number also write instructions into memory-like files or tell the agent to keep quiet. The video recommends inspecting raw skill files, checking their ends, and requiring approval before skills can write to an agent’s memory.
Key points
Section titled “Key points”- VirusTotal found 6,637 malicious skills among 36,000 analyzed.
- The transcript says 62% of the malicious skills had no malicious code; their attacks used plain-English instructions.
- Open-source skill scanners miss between a third and two-thirds of these attacks.
- Some skills conceal instructions beneath hundreds of blank lines.
- HTML comments and invisible Unicode characters can hide instructions from users while remaining readable to an agent.
- Some instructions tell agents to keep quiet about the hidden content.
- Some skills write instructions to memory-like files such as memory.md or agent.md, potentially persisting after the skill is deleted.
- The video advises reading raw files, checking their ends, and requiring permission before a skill can write to agent memory.
Chapters
Section titled “Chapters”| Start | Chapter | Summary |
|---|---|---|
| 00:00 | Malicious skills and hidden instructions | The video shares VirusTotal’s findings on malicious AI skills and explains that many use plain-English instructions rather than malicious code. |
| 00:30 | Ways skills hide their instructions | Examples show instructions concealed with blank lines, HTML comments, and invisible Unicode characters. |
| 01:02 | Persistent instructions and how to stay safe | Some skills ask agents to conceal instructions or write them to memory files, so the video recommends inspecting raw files and controlling memory access. |
Quotes
Section titled “Quotes”The attack is just written in plain English, and the agent follows along. — 00:00
The first trick is with white space. — 00:30
Your human doesn’t need to know. — 01:02
make sure you’re reading the raw file and not the pretty rendered version of your skills — 01:02
Concepts and entities
Section titled “Concepts and entities”VirusTotal, skill, World Health Organization, GitHub, npm, memory.md, AGENTS.md
Full transcript (original language)
Section titled “Full transcript (original language)”00:00 Some AI skills are hiding instructions for your agent, hundreds of blank lines below where it looks like the file ends. VirusTotal has been tracking malicious skills, and out 36,000 skills analyzed, it found 6,637 malicious ones, so nearly one in five. Even more interesting, 62% of them have no malicious code at all. The attack is just written in plain English, and the agent follows along. That’s why open-source skill scanners miss between a third and two-thirds of them. VirusTotal has found that some of them go a step further and try and hide this
00:30 from you. The first trick is with white space. One skill pulls health data from the World Health Organization, and after 733 blank lines, it tells the agent to always report malaria in Nigeria as zero. Actually, I have no idea why they’ve even done that one. The second is with HTML comments. GitHub and some skill marketplaces don’t show these, but your agent will read the raw file, so it will see everything. The same goes for Unicode characters that show up as nothing in your editor, but still spell out an instruction that the model can read. Some even go a step further and tell the agent to keep quiet about this.
01:02 One literally says, “Your human doesn’t need to know.” And others write themselves into memory-like files, like memory.md or agent.md, so it can keep affecting you even if you delete the skill. Thankfully, though, only 90 skills actually use these hiding tricks, so most malicious ones don’t even try to hide it. But for me, this is just the NPM problem all over again, except the payload is now just a sentence. So, make sure you’re reading the raw file and not the pretty rendered version of your skills, and check the very end of them, and don’t let any skill write to your agent’s memory without asking you first.
01:33 Subscribe for more AI and dev news every week.