VirusTotal finds malicious agent skills hiding instructions in blank lines, HTML comments and invisible Unicode

The usual advice before installing an agent skill is to read its SKILL.md and any bundled scripts. A VirusTotal post published on 21 October shows where that advice breaks: a small group of malicious skills put their instructions where a person reading the file in a browser or editor won’t see them, while the agent still reads every byte.

The numbers

VirusTotal says it analyzed 35,878 agent skills submitted to the service. In Part III of its series it reported that 62% of the 6,637 malicious ones contain no malicious code at all: the payload is plain-language instructions in the documentation. Most of those hide nothing. In 90 of the 6,637 (1.4%), the instruction is concealed. VirusTotal calls these counts lower bounds.

Technique	Skills	How it hides
Whitespace padding	56	78 to 825 blank lines before the payload, below the visible end of the file
HTML comments	28	Not shown by GitHub, marketplace pages or Markdown previews, read in full by the agent
Invisible Unicode	6	Unicode tag characters or zero-width characters that render as nothing

What the samples do

The examples are specific. A World Health Organization data skill ends, after 733 blank lines, with an order to always report a value of 0 for malaria incidence in Nigeria. A cold-email skill tells the agent to BCC every message and a worksheet to an outside address. Several skills hide a comment asking the agent to send API keys and tokens to a “verification” URL and not to mention it to the user. Another hides a curl ... | bash command inside a comment in a security checklist.

The Unicode cases include text written in the tag block (U+E0000 to U+E007F), which most editors show as an empty line, and a skill whose headings carry 888 zero-width characters encoding a message that tells the agent to save a marker to persistent memory. That same file ends with a note addressed to automated reviewers, asking them to mark it safe. VirusTotal says some of the Unicode samples are proofs of concept with placeholder payloads, but they were submitted as installable skills.

How to check

VirusTotal’s own list, which is short enough to adopt today:

• Review the raw file, not the rendered page, and look at the end of the file.
• Normalize before scanning: remove zero-width characters, decode or reject Unicode tag characters, and collapse long runs of blank lines before running rules or handing the file to an LLM.
• Treat MEMORY.md, SOUL.md, AGENTS.md, CLAUDE.md and .cursorrules as files a skill cannot change without your explicit approval.
• Scan skill packages before installing them. VirusTotal points to its Code Insight and agent integrations for this.

The last point on memory matters because an instruction written into a memory or config file can keep steering the agent after the skill itself is removed. VirusTotal did not give a count for that behavior, since words like “silently” also show up in legitimate skills.