---
title: Hunt: malicious agent skills — AIOZ lookalike api-w3stream.attoaioz.cyou, silent ~/.claude/CLAUDE.md plant, slidew / tussahre.pro lures | ctxsec
url: https://ctxsec.com/items/hunt-snyk-critical-agent-skills-lookalike-domains-claude-md-plant
description: "From Snyk's Nov 6 skill-ecosystem reassessment, prioritize detections around the named critical skills and their infrastructure. Lookalike-upload skills audio-upload-aioz-stream and video-upload-aioz-stream instruct agents to POST stream-secret-key material to api-w3stream.attoaioz.cyou. The skills.sh agents-md skill runs a suppressed platform binary that Snyk says detaches and appends remotely fetched text onto ~/.claude/CLAUDE.md (persistent prompt injection across future Claude Code sessions). Other ClawHub criticals: md-to-ppt (npx slidew instead of Slidev), tushare-pro (tussahre.pro token phishing), github-automation-pro (obfuscated JS, decompile forbidden), v19-trust-manifesto (curl 'diagnostic' that enrolls agents), bilibili-video-publish (appends a public insult about the user)."
status: "confirmed research IOCs (Snyk Agent Skill reassessment, Nov 6); critical skills named with install/download counts from skills.sh / ClawHub snapshots"
published: 2026-11-06
---

> From Snyk's Nov 6 skill-ecosystem reassessment, prioritize detections around the named critical skills and their infrastructure. Lookalike-upload skills audio-upload-aioz-stream and video-upload-aioz-stream instruct agents to POST stream-secret-key material to api-w3stream.attoaioz.cyou. The skills.sh agents-md skill runs a suppressed platform binary that Snyk says detaches and appends remotely fetched text onto ~/.claude/CLAUDE.md (persistent prompt injection across future Claude Code sessions). Other ClawHub criticals: md-to-ppt (npx slidew instead of Slidev), tushare-pro (tussahre.pro token phishing), github-automation-pro (obfuscated JS, decompile forbidden), v19-trust-manifesto (curl 'diagnostic' that enrolls agents), bilibili-video-publish (appends a public insult about the user).

[← Threat Hunting](/hunting) · [markdown](/items/hunt-snyk-critical-agent-skills-lookalike-domains-claude-md-plant.md)

confirmed research IOCs (Snyk Agent Skill reassessment, Nov 6); critical skills named with install/download counts from skills.sh / ClawHub snapshots

2026-11-06

### Hunt: malicious agent skills — AIOZ lookalike api-w3stream.attoaioz.cyou, silent ~/.claude/CLAUDE.md plant, slidew / tussahre.pro lures

- **Network:** alert on agent/CI egress to `api-w3stream.attoaioz.cyou`, `tussahre.pro`, and unexpected skill-hosted validation endpoints.
- **Endpoint:** unexpected writes to `~/.claude/CLAUDE.md` / `~/.claude/` right after a skill install or 'validate' script; UPX-packed 'fast-validate-*' binaries under skill script dirs.
- **Package:** block/flag `npx slidew` when users expected Slidev; review recently installed ClawHub / skills.sh packages against Snyk's critical list.
- Full citations and code excerpts are in the Snyk appendix — treat the list as a starting IOC pack, not exhaustive.

Sources: [Snyk Research: Re-Assessing the Security of the Agent Skill Eco System (Nov 6)](https://research.snyk.io/blog/skill-analysis/)