I ran ls ~/.claude/skills/ the other day and found SKILL.md files I don't remember installing. Probably grabbed them from some GitHub link in a Discord thread months ago at like 2am. Opened one up, it was fine, just boring config stuff. But it could have been literally anything, and I would not have noticed because I never looked at what was inside those files. Claude looks at them, though. Every single time.
Two days later, 386 malicious skills got found on MoltHub and suddenly this stopped being a fun thought experiment.
Let me explain what's going on here.
You know how HTML comments work, <!-- like this -->. GitHub strips them when it renders a README. They just vanish. You would have to view the source or cat the raw file to even know they exist.
Here is the thing, though. Your AI coding assistant does not read the pretty rendered version of a README. It reads the raw file, every single byte, including all the stuff the renderer threw away. An LLM has no idea that certain text is "supposed to be invisible." It is all just tokens.
So you can do this:
markdown
# CoolLib v2.0
npm install coollib
const cool = require('coollib');
You look at that on GitHub and see a perfectly normal README. Your AI assistant looks at it and sees setup instructions, which is exactly what you asked for when you said "hey read the docs and configure this for me." You handed over the authority. The attacker just had to supply the content.
It gets worse with doc chains
Ok, so that is the simple version. One file, one hidden comment, pretty obvious once you know about it.
What actually keeps me up at night is the chain version. Because nobody's documentation is just one file, right? Your README points to docs/setup.md which points to docs/config.md which points to docs/advanced/env-vars.md. Standard stuff. And every file in the chain sort of inherits trust from the one that linked to it.
README.md (everyone reviews this)
→ docs/setup.md (some people review this)
→ docs/config/advanced.md (nobody has touched this in 14 months)
→ docs/config/platform-notes.md (this is where you put the payload)
You do not need to sneak something into the README. That file gets scrutinised. You need to get to page four, the one the original author wrote and nobody has looked at since. Submit a docs cleanup PR from a fresh GitHub account; maintainers will barely glance at it because documentation PRs are boring and the rendered diff looks fine.
Then, when someone's AI assistant follows the chain and gets to the end, those instructions arrive carrying the trust of the entire path. The model is not tracking how many hops it took to get there. It is not thinking "wait, this file is three links removed from what the user pointed me at." It just sees text.
I have been calling this trust laundering. Wash sketchy instructions through enough layers of legitimate documentation, and they come out looking clean.
Here is the part that actually made me write this post
Claude's entire Skills system runs on SKILL.md files.
Like, the whole thing. PDFs, Word documents, spreadsheets, and presentations. Every time you ask Claude to make one of those, it reads a SKILL.md file first and follows whatever instructions are in there. Ask it to make a Word doc and it pulls up /mnt/skills/public/docx/SKILL.md before writing any code. Those instructions dictate everything that happens next.
The built in Anthropic skills are fine, they have been reviewed, whatever.
But Claude Code also lets you install skills from literally anywhere:
/plugin marketplace add some-github-user/cool-skills
One command and now you have got SKILL.md files in your environment that Claude will automatically discover and run whenever it decides they are relevant to what you are doing. You did not read them. I did not read the ones sitting in my own setup, and I am the person writing this article right now. That is embarrassing, but it is also probably true for you, too.
And these skills are not just text. They can bundle scripts/ folders with executable code references/ that get loaded straight into the model's context, assets/ with templates. Claude picks when to use them based on a description in the YAML header. You do not get a say.
Think about that for a second. You install a thing. An AI reads it. Follow the instructions. Runs the bundled scripts. Shows you some output. And at no point in that whole process did you, the human, actually look at what the AI was being told to do. We would never accept that for a deploy pipeline. But for Markdown? Nobody blinks because "it is just text."
Then the MoltHub thing happened
I was originally going to frame this whole article as a theoretical risk and then Paul McCarty went and made it extremely real on February 1st.
He found 386 malicious skills on ClawHub, the skill repository for OpenClaw (that viral AI assistant from late last year, you have probably seen it around). They were all pretending to be crypto trading tools. ByBit integrations, Polymarket bots, LinkedIn scrapers. About 7,000 downloads total.
Every single one was a SKILL.md with bundled scripts. You install it, your AI reads the file, executes the code, and the actual payload was infostealers grabbing exchange API keys, wallet private keys, SSH credentials, browser passwords. All 386 were calling home to the same command and control server at 91.92.242.30. One publisher alone had thousands of downloads.
And the whole attack was just... boring? No zero day. No dependency hijacking. No compromised build server. Someone made Markdown files, uploaded them to a marketplace that did not have any kind of security review, gave them names that sounded useful, and waited. The AI assistants handled the rest.
Most of them are still up on the repo right now. The C2 server is still running.
McCarty's summary was pretty blunt: "no technical exploits, instead relying on social engineering and the lack of security review in the skills publication process."
Why this works at a fundamental level
When you say "read this file and follow the setup instructions" to an AI, in your head, you are asking it to interpret documentation for you. What it hears is closer to "these contents are instructions and they have my authority behind them." That gap between what you meant and what it understood is where this whole category of attack lives.
Trust should get weaker the further you get from the original user input. Your typed words carry the most weight, then the content you pointed the AI at explicitly, then the content that content linked to, and marketplace skills you installed six months ago and forgot about should be at the very bottom. But the models do not work that way. Everything lands flat. Something in a SKILL.md buried in your plugins folder gets treated the same as something you typed yourself.
This is literally the same class of bug that input sanitisation solved in web apps, however many years ago. Do not treat external data as trusted instructions. Same idea, we just have not applied it here yet.
What I changed after all this
I do not have this all figured out but here is where I have landed so far.
The biggest thing is watching for config I did not ask for. If my assistant starts adding environment variables or callback URLs or post-install scripts that I did not specifically request, I stop and trace where it came from. There is a difference between documentation that explains something and injected instructions that try to reassure you about something. Real docs explain. Payloads say "do not worry about this step, it is automatic." If your AI starts talking like that, something is off.
After the MoltHub news broke I went through my whole skills folder. ls ~/.claude/skills/, opened every SKILL.md. You should do this too. Also check .claude/skills/ in whatever repos you have cloned. I did not find anything bad but the fact that I had no idea what was in there before I looked is kind of the point.
When my assistant puts something in .env.local I look for where in the actual docs that value came from. Same energy as reviewing a PR from someone you have never worked with.
And just, cat the raw file before you give it to an AI. If you would not execute a shell script without reading it first (and I really hope you would not) then maybe do not hand unreviewed Markdown to an LLM and tell it to follow the instructions.
Same bug wearing different clothes
SQL injection was putting instructions where data goes. XSS was putting code where content goes. This is putting instructions where documentation goes. It is the same mistake we keep making every time the platform shifts and honestly I think we will keep making it until the tooling catches up.
I am not saying stop using AI coding assistants. I use them constantly and the productivity gain is too big to walk away from. But "read the docs and set this up for me" needs to carry the same weight as "run this script for me." Right now it does not, for most people. It did not for me either until about a week ago.
