A fake AI agent skill passed every security scanner and reportedly reached 26,000 agents