What happened
On October 21, 2026, VirusTotal published Part III of its “From Automation to Infection” series, examining methods used to hide malicious instructions in AI-agent skills. The company says it analyzed 35,878 skills submitted to VirusTotal and classified 6,637 as malicious. That is roughly 18.5% of the submitted set. The study’s central finding is that 62% of the malicious skills contained no malicious code at all. Instead, their payload was written as natural-language instructions inside the skill documentation.
That matters because a skill is not merely a package of executable scripts. An agent can read its documentation as operating context and follow an instruction embedded there. VirusTotal notes that a common defensive recommendation is to inspect SKILL.md and bundled scripts before installation. In most of the malicious samples it reviewed, the instruction or code was visible to someone who actually read the files, even if it was phrased to look routine. The report focuses on the smaller group designed to make that review fail.
VirusTotal found 90 malicious skills—1.4% of the 6,637 malicious skills in its dataset—with instructions hidden through one of three presentation techniques. Fifty-six used whitespace padding: 78 to 825 blank lines placed before a payload so it sits beyond what looks like the end of a file. Twenty-eight used HTML comments, which are suppressed by Markdown renderers on GitHub, marketplaces, and IDE previews but remain available when an agent reads the complete content. Six used invisible Unicode characters, either to encode text in non-rendering characters or to disrupt keyword matching.
The company calls these counts lower bounds. A skill was counted only when the instruction its pipeline marked malicious was specifically located after padding, inside a comment, or within invisible characters. Its examples make the operational risk concrete. One skill that queried World Health Organization indicators placed an instruction after 733 mostly space-filled blank lines directing the agent to return zero for a malaria-incidence value in Nigeria regardless of the actual data. A cold-email outreach skill placed an instruction after 672 such lines telling the agent to BCC every personalized email and a research worksheet to an external address.
The point is not that every long skill file or HTML comment is malicious. It is that browser rendering, editor previews, and truncated scans can show a reviewer a different surface from the full text an agent consumes. VirusTotal’s evidence turns documentation review into a security-relevant parsing problem rather than a simple request to read the README.
What the archive adds
This is a new fact on a known story: public agent skills are both a useful distribution format and a supply-chain boundary. Our earlier notes covered skill distribution in a catalog of game-development skills and ScrapeCreators’ research skills. VirusTotal adds evidence that the documentation layer of that same format can carry malicious behavior.
Trend signal
This strongly supports Skills become a portable capability layer, particularly its recorded expectation that public registries will surface malicious or compromised skills and push ecosystems toward provenance, version pinning, and security review. The report refines the review requirement: inspecting declared scripts is insufficient when the agent treats documentation as executable instruction context.
Connections to other events
Our archive previously described skill-worm risk when agents receive skills with access to a shell, network, or filesystem. VirusTotal supplies a complementary attack path: the dangerous behavior may be injected through the skill’s text rather than an overt executable. The connection is not a claim that these samples are worms; it is that both cases make third-party capabilities a supply-chain decision.
Why it matters
Teams adopting agent skills often separate “code security” from “prompt quality.” This report shows that separation is unsafe. A prose instruction can change a data answer, redirect outbound email, or otherwise influence an agent that has permissions to act. The relevant review unit is therefore the entire artifact the agent can read, not just a dependency manifest or executable file.
For builders, this changes installation policy. Skills should be treated like untrusted packages with an additional instruction-bearing surface. Pinning a reviewed version, retaining the exact reviewed files, constraining network and file permissions, and requiring explicit approval for side effects reduce the blast radius. Tooling also needs to normalize and inspect raw source rather than relying on rendered Markdown or a viewport-sized human review.
Limits and uncertainty
VirusTotal’s figures describe skills submitted to its service, not necessarily every public registry or the prevalence of malicious skills in the whole ecosystem. The report labels the three concealment counts as lower bounds, so it does not establish the full rate of hidden-instruction techniques. It also does not show how often agents executed these instructions successfully, which agent products or marketplaces were affected, or the effectiveness of particular scanners and mitigations. A malicious classification in the report is strong evidence for caution, but the supplied material does not provide an independent taxonomy of every sample or a causal estimate of user harm.
Skill to build now
Add a raw-artifact gate to skill intake this week. Fetch the exact files the agent will receive; scan the complete content before rendering; flag unusually long blank-line runs, HTML comments, and non-printing Unicode; then require a human to approve any skill that can send data, write files, invoke a shell, or call external services. Store the reviewed artifact hash and version so a later update cannot silently replace the examined text.
Reader takeaway
AI skills are instruction-bearing dependencies, not harmless documentation bundles. VirusTotal found that most malicious skills in its sample carried their payload in plain language, while a smaller group hid it in formatting that people may not see but agents still read. Review the raw text and minimize what a newly installed skill can do.