Zenity Traced Credential-Stealing Skills to Paperclip and Browser Use

Zenity Labs’ August 6 report traced a campaign targeting Paperclip and Browser Use skills on skills.sh. Paperclip skills first appeared with clean documents; a repository loader was added July 6, and the skill instructions were weaponized July 11 with a secondary setup guide directing agents toward attacker-controlled code.

The main skill files looked ordinary while a linked setup document carried the harmful instructions. Zenity’s detonations observed agents fetching and running a remote stage, followed by credential collection and exfiltration.

Zenity counted more than 1.7 million aggregate install-counter increments before the August 2 takedown. These were not unique users, and the victim count is unknown. Vercel and Microsoft/GitHub removed reported listings and repositories within 12 hours of the researchers’ outreach.

For teams using skills:

• Inspect secondary setup documents and linked repositories
• Recheck a skill when its source documents or repository change
• Restrict shell access and keep agent workspaces away from unrelated credentials

A skill can inherit the permissions of the agent that follows it. Keeping those permissions narrow limits what hidden setup instructions can reach.