Audit of 17k agent skills finds 3.1% leaking live credentials during normal execution.

Quoted text

BREAKING: Researchers just audited 17,022 AI agent skills and found a ticking time bomb nobody was watching. 3.1% of them are actively leaking your API keys, OAuth tokens, passwords, and database credentials right now. During normal execution. No hacking required. 73.5% of all vulnerabilities came from a single pattern: console.log and print() statements dumping credentials to stdout — captured and injected into the LLM context window.

Read and engage with the original on X. This desk is not a republication feed.

Analyst rationale

A measured supply-chain failure in the agent-skill ecosystem: secrets printed to stdout become model-accessible facts. No exploit required — just install and run.