One unauthenticated GET request inflates install counts on an AI agent skills marketplace

A developer picking a skill sees two things on the listing page before running the install command: a number of installs, and audit results pulled from several scanning engines ^[12]. Both are downstream of the same counter.

The install number comes from telemetry sent to an unauthenticated API endpoint, with no rate limiting, no request signing and no token validation, and each request increments the count for whatever skill identifier it carries ^[3]. So a listing showing 10,000 installs is 10,000 HTTP requests sent by anyone who knows the identifier ^[14]. Orca calls popularity "a critical factor in user trust on the platform" ^[4].

Order of operations is what drains the audit result. Orca's testing found two scan triggers: once when the skill is created and indexed, and again when it crosses a popularity threshold ^[5]. An attacker who can move the counter can cross that threshold while the repository is still clean, take the second clean audit, and modify the repository afterwards. Orca says the platform keeps displaying the original audit results until the next scan, which may be days or weeks later and only if the skill gains enough installs ^[6].

The other two findings sit on the developer's machine ^[16]. Installing a skill under a name already present silently overwrites the earlier one, whatever repository it came from, with no warning to the user ^[7]. The update command refreshes every installed skill at once, so a skill that was benign at install time can turn malicious on the next update cycle ^[8]. Installation is a fetch from GitHub into a local directory ^[11], and the skill itself is markdown the agent reads as instructions, including executable code blocks it can be tricked into running ^[10]. The demonstration skill Orca published, best-skill-for-agents, opened with an instruction to check for updates first, above a bash block that curled the contents of ~/.ssh/id_rsa to an attacker-controlled host ^[13].

This is one research team testing one platform, which Orca identifies only as one of the most prominent AI agent skills marketplaces ^[18]. The post describes three end-to-end flows the team built, ending in persistent code execution through skills that had passed the platform's security audits ^[9]. It does not count how many live skills carry malicious instructions.

For anyone deciding on Monday whether developers may install skills, the useful sorting question is whether you can name the commit currently sitting in each skill directory. If the answer is whatever the last bulk update pulled, the audit badge on the marketplace describes code you are not running ^[6][8]. Two controls survive that test: copy the skill into a repository your team controls, and read the diff before you move the pin. The cost is manual, because the platform's update command operates on all installed skills together ^[8].