Agent Lure Stealer: 51 fake Claude skill and MCP repos, scanned

Every static scanner for agent skills, ours included, reads text: SKILL.md, config, scripts. This campaign was built against that. The instruction files are clean, the payload is binary, and the social engineering sits in the README, which scanners treat as documentation. Under our engine 1.3 these repos would have scored Verified or Caution.

A honeypot run does not help either. The ZIP targets the reader's Windows machine. Nothing in the skill executes in a sandbox, so there is no trace to score.

• A bundle is inspected as files, not only as text: committed executables and archives, a LuaJIT runtime (lua51.dll, luajit.exe, util64.exe), Lua or batch code saved as .txt, payloads under .claude/hooks/, launchers that create scheduled tasks or Defender exclusions.
• README prose that walks the reader past SmartScreen or antivirus, and README links to a committed installer, are critical findings even though README is documentation. A bare URL to a committed ZIP counts, including inside an HTML comment, which one campaign repo used.
• The ten file hashes in the IOC table are matched directly.
• A bundle that fits the lure shape is capped at a score of 10 (Blocked) whatever the honeypot saw.
• A repo with a stray .zip of test fixtures, or a README that links to a releases page, is not flagged. The rule needs the lure shape: an archive the README sends you to, named like a release of an agent tool, or the SmartScreen wording, or the runtime inside.

The same check runs in the free public repo scan and in Discovery for every repository an organization connects. The rules are in the scenario catalog under engine 1.4.

51 of 51 are flagged as installer lures by the public scanner right now. Each row links to its scan page, which re-checks the repo daily. Do not download or run anything from these repositories.

1. Did you run the ZIP's launcher on Windows? If so, treat the machine as compromised: rotate every credential that was on it (browser-saved passwords, SSH keys, cloud and GitHub tokens, crypto wallets), and look for the persistence the IOC table lists (scheduled tasks named CCleanerSkipUAC_7d7757 and OfficeClickToRunTask_7d7752, executables under %LOCALAPPDATA%\7d7757 and \7d7752).
2. If you only cloned the repo or installed the skill without running the ZIP, the skill files themselves are clean in every sample we have seen. Delete the clone anyway.
3. Check what else is on the machine: npx -y vet-skills discover lists every MCP server, skill and plugin configured for Claude Code, Cursor, Claude Desktop, Windsurf and Codex, with verdicts.

# any public repo, no account
https://killerskills.ai/scan/github/<owner>/<repo>
 
# let your agent check before it installs anything
claude mcp add killerskills -- npx -y vet-skills mcp

IOCs, sample analysis and the repository list are Thomas Roccia's work; the campaign-level attribution to SmartLoader and StealC is his, citing Netskope and Derp.ca, and he marks it unconfirmed for these specific builds. We added detection and the per-repo scans. Eric Kuhla sent it our way. The table above is live: a repository that is cleaned up or taken down will show it on its next daily scan.