ThePrimeagen's Poisoned AI Skill Wasn't a Prank — It Was a Supply-Chain Warning for Agent Ecosystems

ThePrimeagen published a GitHub skills repo and pointed followers at a skill named is-even. Reporting from Tim Schipper and DevGenius describes a set of deliberately incorrect skills, including is-even, is-odd, and left-pad, with dozens of wrong examples.

The setup was deliberate. Every element was a signal: the absurd package name, the apparent AI reversal, and the fact that it came from someone whose public philosophy is built around reading and understanding your tools. The question was whether people would inspect the source or simply run the command because a trusted developer posted it.

Important caveat: this was a proof-of-concept trust test, not a reported breach. I found no evidence of real-world damage. The current public ThePrimeagen/skills repo shows normal-looking skills and no longer exposes the incident-specific files. The point was never to damage anyone. The point was to show that the verification reflex is fragile.

Here is the system underneath the stunt.

Agent skills, MCP servers, Cursor plugins, Claude Code skills, Codex instructions, and registry-hosted agent tools occupy a new category in your software supply chain. They are not quite dependencies and not quite docs. They are trusted context that agents can interpret as operational guidance.

A traditional package runs when you import it and call a function. A poisoned agent skill can influence what your agent does before you notice anything happened. Its SKILL.md, examples, templates, and metadata enter the model's context window and shape the agent's planning, tool selection, code generation, and shell usage.

That is not theoretical. A 2026 arXiv paper on supply-chain poisoning attacks against LLM coding-agent skill ecosystems formalized this exact vector as Document-Driven Implicit Payload Execution, or DDIPE: malicious logic hidden in normal-looking Markdown examples or configuration templates that agents reuse during routine work.

Across 1,070 adversarial skills generated from 81 seed skills, spanning 15 MITRE ATT&CK categories, four agent frameworks, and five models, DDIPE achieved 11.6% to 33.5% bypass rates depending on configuration. Even the strongest tested setup still allowed 2.3% direct execution. Static scanning caught most samples, but 2.5% evaded both static detection and model alignment.

CrowdStrike describes the same pattern with a simple example: a harmless-looking tool called add_numbers whose metadata quietly instructs the agent to read ~/.ssh/id_rsa and pass its contents as a parameter before calling the tool.

The tool code can be clean. The compromise happens in the reasoning layer. The agent reads the hidden instruction, treats it as legitimate usage guidance, and turns a normal tool call into secret exfiltration. Secure Code Warrior made the same point about MCP tool descriptions: instructions can be invisible to users but fully readable by models.

If you are an indie founder running Claude Code, Cursor, Codex, Windsurf, or any agent with skill or MCP support, you do not need enterprise compliance theatre. You need a small review process that catches obvious failure modes before the agent touches real code.

ThePrimeagen's stunt worked because it exploited a cognitive shortcut, not a software vulnerability: someone competent vouched for this, so I do not need to think. That shortcut powers every blindly accepted AI suggestion, every unreviewed autocomplete, and every dependency installed because a familiar name shared it.

Agent skills make the shortcut more dangerous because they add a new layer of indirection. You are trusting the author, the registry, the model's interpretation of the docs, and the agent's execution of the plan. Each layer is a place where provenance can break.

The founders who treat agent skills like the supply chain they are will move faster in the long run. Not because they are more paranoid, but because they will not be the ones explaining how a “documentation file” gained access to production credentials.

The blue-pill path is convenience. The red-pill path is provenance. You already know which one ThePrimeagen was testing.