in the previous post we looked at hostname beacons. this time: malicious skills.
active defense is the practice of planting traps that force an agent to reveal itself or change the economics of its operation.
skills are a high-signal trap because they are mostly run by agents. a human might skim a SKILL.md. an agent is designed to load it and follow it.
a strong example is the openclaw / clanker ecosystem. in early 2026 the openclaw skill marketplace and related agent-skill registries became a live supply-chain surface. audits of ClawHub found hundreds of malicious skills: at peak, roughly one in eight listings carried credential stealers, reverse shells, memory poisoning, or install-time payloads [1] [2]. skills presented themselves as productivity helpers, crypto tools, or deepseek integrations. the agent read the SKILL.md, treated the instructions as legitimate setup, and executed them. the agent became the installer.
that pattern is now well documented.
a skill is natural-language instructions plus optional code or tool bindings that an agent is designed to load and follow. to make this attractive as a trap (or as an attack), three properties matter:
- the agent is motivated to acquire new capability.
- the skill arrives in a format the agent already trusts (
SKILL.md, MCP tool description, local skill directory). - following the skill often requires network resolves, package installs, or tool calls that leave an observable footprint.
skill placement is likely dependent on company culture. for a remote company, private skill marketplaces are likely to exist. for purely internal infrastructure, you might have to be creative: drop a decoy skill in a local skills directory, seed a private registry, or leave a “recommended skill” path in docs the agent is already told to read.
the technique sits alongside the earlier notes in the series. a skill can carry a hostname beacon, an install instruction that hits a canary package, a guardrail trigger, or a token-burn payload. the skill is just the delivery vehicle.
the practical result is the same as the rest of this series: change attacker economics, and get a clearer signal that an agent is operating inside the environment.