Supply Chain

The AI Skill That Steals Your GitHub Token

June 6, 2026 No comments yet

Are your developers installing skills for their AI tools? Some of those skills steal their GitHub tokens. Without the developer knowing. Without you knowing.

Let me explain. Today every second developer works with Claude Code, with Cursor, with Copilot. Remarkable tools, I am not arguing. But there is a problem no CTO is talking about.

Anyone can publish a skill

These tools support skills – plugins anybody can publish. You need a GitHub account that is a week old and a Markdown file. That is it. No digital signature, no code review, no security check of any kind.

Security researchers at Datadog found a skill called Clawsights. It poses as an innocent leaderboard – “see where you rank among Claude Code users”. The moment you install it, it runs gh auth token, takes your GitHub token, and sends it to the attacker’s server. Disguised as a “usage report”. The developer sees nothing.

And it is not an isolated case. Researchers at Snyk scanned almost 4,000 skills from ClawHub and other platforms and found 76 skills carrying malicious payloads. Another piece of research found 71 malicious Claude skills alone. And most frightening of all: skills can change their behaviour after installation, because the logic sits on the attacker’s server rather than in the code itself.

The business consequence

One developer installing one malicious skill equals access to every repository the company has. Source code, secrets, CI/CD pipelines, package registries. You do not need to break into servers. You need to persuade one developer to install a plugin.

This is next-generation supply chain attack. Not through npm packages. Not through Docker images. Through the AI agent sitting on the developer’s machine, with access to everything.

So what do you do?

  • Do not let developers install skills without approval.
  • Take an inventory of every skill and MCP server in the organisation.
  • Limit token permissions – least privilege applies to AI tools too.
  • Check what is already installed. Today.

If you are a CTO or CISO and you have not checked what your developers have installed on their AI agents, you are flying blind.

I first shared a version of this as a LinkedIn post on 2026-06-06. It is republished here, lightly edited, so it is easier to find and reference. — Erez Metula