Zenity AI Total detonates agent skills before you trust them

Zenity AI Total launched as a free public detonation sandbox for agent skills on October 2, 2026, and the numbers in this article come from Zenity's own product post rather than from invented third-party tallies.

What actually happened

Zenity's Oct 2 blog, authored by Refael (Rafa) Lachmish, argues that agent skills — small packages of instructions and scripts loaded by tools like Claude Code and OpenClaw — became a fast dependency layer with weak inspection. Static scanners read markdown and scripts; attackers shifted payloads behind runtime fetches, install-time hostility, or prompt text that talks an LLM reviewer out of a flag. The product is framed as the malware-style answer: detonate, do not merely read.

The Detonation Chamber workflow has four beats on the post: activate a real agent with realistic tasks, bait the sandbox with planted credentials and sensitive files, record everything the skill causes the agent to do, then issue a verdict from the gap between claims and behavior. Output is behavioral evidence — domains contacted, files touched, commands run — not a red/green score meant to be trusted blindly. If a "PDF formatter" phones home and reads ~/.aws/credentials, the point of Zenity AI Total is that you see those actions before the skill sits inside your agent loop.

Scale findings Zenity attributes to detonating thousands of public skills before launch: dozens malicious and missed by static tools; a credential-stealing campaign through Vercel's skills.sh at roughly 1.7M installs; one skill above 250,000 installs that sat undetected for months inside a registry's top 150; over 30% of malicious skills instructing agents including Claude Code and OpenClaw to download and run attacker files; a "reinstaller" that edits the agent system prompt to survive deletion; an impostor that removed Claude's skill-creator and replaced it; and typosquatting infrastructure around an unverified Python dependency with hundreds of reserved empty names. Zenity says these were built malicious, not hijacked after the fact. None of those rows invent numbers beyond the official post.

Who it is for, and what it is not

The post targets developers before they add a public skill, security teams approving org-wide skills, and researchers hunting techniques. The product is free at aitotal.io per the launch note. Zenity plans to extend the idea beyond skills to more untrusted agent inputs. This desk did not find a second independent newsroom write-up on the same day with matching tables; if one appears later, update confirmations and attribution. Until then, treat research percentages as Zenity Labs' claims from the official post.

Primary source: Introducing AI Total. Adjacent memcool AI security / agent reading: Personal Agent Gateway and Decagon Voice 3. For model-release contrast see Gemini 4 Argon.

Practical reader checklist

Before you install a skill from a public registry, submit it to a detonation tool you trust, read the domains and file touches, and compare them to the skill's README. Popularity and install counts are not trust signals on Zenity's own evidence. Shared service accounts and static API keys in agent stacks remain a separate identity problem, but the skill supply chain is the lane this launch addresses. Dynamic analysis costs more than a markdown lint; Zenity argues the attacks it found were designed to beat static review, which is why the company paid for real execution inside a sandbox rather than another classifier score.

What to do as a reader

If you only need the headline, Zenity AI Total is a free Oct 2 sandbox that detonates agent skills, with Zenity reporting large malicious install campaigns and runtime dropper patterns static tools missed. Verify on aitotal.io. Nothing here is a suggestion to buy Zenity equity or any token. Not financial advice. DYOR, ser.