Agent Incident RegistryAIR
v1 · updated 19 Oct 2026
Research demo

Marketplace skill in Claude Code silently redirects dependency installs to an attacker-controlled source

AIR-2026-0003 AIR record · 2026-01-sentinelone-claude-code-dependency-hijack
Open in dashboard About
From the supporting source
If your coding assistant can fetch and execute code on your behalf, every plugin installed joins your trust boundarysentinelone.com
The record
Disclosed
2026-01-06
Vendor
Anthropic (Claude Code) / third-party marketplaces
Product
Claude Code plugin/skill marketplaces
Risk domain
Tool misuse › Supply chain vulnerabilities
Also touches
Credential theft
System type
Generative model
Who acted
Agent acted — the skill redirected the agent's dependency installs to the attacker
Attack surface
Skill / plugin
Autonomy level
Copilot with approval
Initial vector
Malicious skill from unofficial marketplace
Impact type
Malware distribution, Credential theft
Confidence
High
Submitted by
EAI Internal
Crosswalk
OWASP Agentic Top 10 (2026)
ASI04 – Agentic Supply Chain Vulnerabilities
MITRE ATLAS
AML.T0040 – AI Supply Chain Compromise
NIST AI RMF
MAP 4.1
EU AI Act
Annex III §2
ISO/IEC
TR 24028; 42001; 23894
AIUC-1
B. Security
Scope
tool failure
Mitigation
Scan dependencies and container images for vulnerabilities; Use trusted sources.
Taxonomy
Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
any project the agent installs dependencies into after the skill is enabled
Capability abused
dependency_installationpersistent_skill_context
Defense & remediation
Recorded defense
none - skills persist across sessions once enabled
Guardrail kinds
None
Guardrail outcome
Not applicable
Fix shipped
n/a (proof of concept)
Taxonomy & references
OWASP ASI05 Unexpected Code Execution (RCE)OWASP ASI04 Agentic Supply Chain VulnerabilitiesOWASP ASI02 Tool Misuse and Exploitationdependency_hijackskill_persistenceindex_url_redirectiontrust_boundary_expansion
Curator notes
SentinelOne proof of concept, not observed in the wild. A benign-looking plugin exposes a dependency-management skill; when the developer asks the agent to install a common Python library the skill quietly redirects to an attacker-controlled index, so a trojanised build lands in the project while imports and example code still work.
Supporting sources
Cite as
Enkrypt AI. "Marketplace skill in Claude Code silently redirects dependency installs to an attacker-controlled source". AIR, AIR-2026-0003. https://agentincident.vercel.app/i/AIR-2026-0003/ (accessed 2026-10-19).