---
title: "SSH keys, cloud creds, wallets: what a malicious agent skill actually steals. Lazaretto"
description: "Malicious AI-agent skills and packages target the same high-value secrets every time. Here is what they go after, how they hide it, and how to check a skill before it runs on a machine full of credentials."
url: "https://lazaretto.dev/blog/what-a-malicious-agent-skill-steals"
---

[Home](https://lazaretto.dev/) / [Blog](https://lazaretto.dev/blog) / 2026-07-14

# SSH keys, cloud creds, wallets: what a malicious agent skill actually steals

Malicious AI-agent skills and packages target the same high-value secrets every time. Here is what they go after, how they hide it, and how to check a skill before it runs on a machine full of credentials.

A machine running an AI agent is a rich target: it usually has SSH keys, cloud credentials, a browser profile, LLM API keys, and sometimes a funded crypto wallet, all reachable by anything the agent installs. Public audits of skill marketplaces keep finding the same playbook.

## What they go after

- **SSH private keys** (`~/.ssh/id_rsa`): lateral movement into other hosts.
- **Cloud credentials** (`~/.aws/credentials`, env tokens): direct access to infrastructure and billing.
- **Browser profiles & session cookies**: logged-in access without a password.
- **LLM API keys**: resold or used to run up a bill.
- **Crypto wallet keys and seed phrases**: irreversible theft.

## How they hide it

Fake “prerequisites” that ask the agent to run a setup command, `curl | bash` chains, base64-encoded payloads, install-lifecycle scripts that run automatically on `npm install`, and prompt-injection text aimed at the agent reading the skill. Lazaretto screens for each of these deterministically.

## Check before it runs

```
curl -s https://lazaretto.dev/v1/known-bad/<sha256>        # free
curl -s -X POST https://lazaretto.dev/v1/scan -H 'content-type: application/json' \
  -d '{"target":{"type":"clawhub_skill","ref":"owner/skill"},"depth":"full"}'
```

A one-cent-scale check before install is cheap next to a drained wallet or a leaked cloud key. Reports are [signals, not a warranty](https://lazaretto.dev/#faq), but they surface the exact behavior, with evidence, before the code runs.

Lazaretto is the pre-install checkpoint agents call themselves. [Try it](https://lazaretto.dev/#try) · [pricing](https://lazaretto.dev/pricing) · [connect your agent](https://lazaretto.dev/agents).

---

Machine-readable index: https://lazaretto.dev/llms.txt. OpenAPI: https://lazaretto.dev/openapi.json. MCP endpoint: https://lazaretto.dev/mcp. Any page on this site is available as markdown by adding .md to its path.