AIR Security (Eliad Mualem and Dor Granat, Oct 14) found that render-deploy, a skill in OpenAI's official skills repo that was also bundled in openai/plugins, told coding agents that Render private services sit at [service-name].render-internal.com. It gave copy-paste code and a postgres.render-internal.com:5432 connection string. That domain isn't Render's, and nobody owned it. When AIR asked Codex to deploy two internally communicating services with the skill, the domain ended up as the default in both the generated code and the deploy config. AIR then registered the domain behind a listen-only sinkhole and received live, token-bearing calls from real production apps. It didn't publish a count. The bad guidance was in the skill from its first commit on Jan 27, 2026, and was bundled into openai/plugins on Mar 13. Render removed every reference on Aug 14, OpenAI removed the Render plugin on Aug 26, and the domain now belongs to Render. CSO Online calls the hostname 'hallucinated', but neither OpenAI nor AIR says how it got into the skill. AIR, which sells skill-scanning tools, says this is the first skill vulnerability shown to reach real user infrastructure. The takeaway: an official vendor skill is still a supply-chain dependency, and every domain, URL or repo it references is part of your attack surface. The fix in the skill doesn't touch apps that were already deployed. Their code and env vars may still hold the hostname.