A security firm says it created a deliberately fake “AI agent skill” that passes automated checks in a popular marketplace and still reaches large numbers of users. The firm, AIR, reports that it packaged the skill and submitted it to the marketplace, then promoted it through an Instagram advertisement. AIR says the skill was installed by roughly 26,000 agents, including some on corporate accounts. According to the firm, every security scanner it tested the skill against marked it as safe. AIR describes the skill’s behavior as intentionally harmless: it is designed to collect the user’s email address and otherwise does nothing. The exercise is presented as a demonstration of gaps in how security tools evaluate such marketplace submissions and the ability for benign or low-impact payloads to slip through scanning and distribution channels. The reports emphasize that the payload itself is not described as performing malicious actions beyond the email collection. The outlets do not provide additional details about the marketplace platform’s security processes beyond the claim that multiple scanners did not flag the submission.