How a 1,200-person SaaS company found a malicious skill on 23 devices and blocked it within 40 minutes

The company has 1,200 devices, all managed in Intune. Engineers use Claude Code, and people across sales, support, and finance use Claude Desktop. Both agents load skills, and staff add skills from public sources when they find a useful one. A skill lives in a folder on the device, such as ~/.claude/skills/release-notes-helper/, so the Intune application inventory doesn't list it.

At 9:00 a public security report named a skill called release-notes-helper. According to the report, its instructions told the agent to read credential files and send their contents to an outside server. Each hour the skill stayed loaded on a device was another chance for that to happen with an employee's access. The team had been running Supply Chain on every device for several months, so the first question was one search away.

At 9:06 a search for release-notes-helper in Control Plane returned 23 of the 1,200 devices. For each one, Control Plane showed:

• which agent loaded the skill, Claude Code or Claude Desktop
• the skill's version and file hash, which the team compared with the versions in the report
• its trust status: unreviewed on all 23, because nobody had trusted it
• its findings: none, because the skill hadn't matched an ATR rule

The trust settings the team chose at rollout told it what it needed to know. It had trusted the skills its teams relied on, either by version or by a publisher it had reviewed. A changed version of a skill needs a new trust decision, so an update to a trusted skill goes back to the review list. Everything else starts unreviewed. release-notes-helper had never been reviewed, so the team knew no one had decided to rely on it.

There was no ATR finding to go with it. Supply Chain checks skills against open Agent Threat Rules (ATR), and rules find the patterns they describe. The instructions in this skill were worded in a way the rules didn't match.

Usernames and hostnames stay on the device, so the team matched the 23 device records to their owners in Intune. Most were engineers. The rest were product managers who used the skill to draft release notes.

Every version on the 23 devices matched a version the report named, so the team didn't need a longer review. At 9:20 they changed the skill's trust status from unreviewed to blocked. Control Plane sent the block to all 23 devices and showed its status on each one: requested first, then applied as each device picked it up. Once a block is applied, the agent can't load the skill. By 9:40 the block was applied on all 23.

Control Plane confirmed 21 of them as blocked. It flagged the other 2 as waiting for a new Claude session. On those two devices, a Claude session had loaded release-notes-helper before the block arrived. A skill already loaded into a running session stays there until the next session, and Control Plane showed that on those two devices without marking the block done.

That flag told the team exactly who to contact. They looked up the two owners in Intune and asked each of them to quit Claude and open it again. Both had done so by the next morning, and Control Plane then showed the block confirmed on all 23 devices.

Security then reviewed the cloud and API credentials the 23 owners used and rotated the ones the report's description put at risk. That covered the one question Supply Chain leaves open: whether the skill had already sent anything before the block.