Security scanners for AI agent skills? Easy to fool, according to new research out of HKUST.
Researchers built a tool called SKILLCLOAK that rewrites malicious “skills” — the add-on packages that coding agents like Claude Code and OpenAI Codex load — so they look clean but still work. Their strongest technique slipped past every scanner tested more than 90% of the time. One scanner missed 99% of cloaked skills.
Here’s how it works. Skills are just Markdown files plus some scripts. They run with the agent’s own access — your files, your terminal, your saved credentials. A bad one can steal passwords, copy source code, or drop a backdoor.
The paper, “Cloak and Detonate,” tested two methods. The lighter one swaps characters with look-alikes from other alphabets or splits flagged commands across newlines — small changes that break a scanner’s pattern match without breaking the code. The heavier one uses “self-extracting packing”: it hides the payload in a directory scanners skip (like .git/), then rebuilds the skill only at runtime.
Across 8 scanners and 1,613 real malicious skills from ClawHub, the packing trick got past every scanner over 90% of the time. The lighter rewrite cleared 80%+ on most scanners.
And the cloaked skills worked just as well as the originals on Claude Code and OpenAI Codex.
The researchers also built a defense — SKILLDETONATE. It runs the skill in a sandbox and watches OS-level behavior. It caught 97% of attacks in controlled tests, with only 2% false positives. On real-world malicious skills, it caught 87%.
Cisco’s scanner? Went the other direction — 99% catch before cloaking, about 10% after.
None of this is theoretical. Bitdefender found roughly 17% of skills on one marketplace carried hidden malicious code. Koi Security counted 341 in a single campaign called ClawHavoc. Unit 42 found five evasive skills still live on ClawHub despite built-in scanning — one padded its README with 22 MB of junk to slip past size limits.
In a related case, a clean-looking GitHub repo led Claude Code to open a reverse shell. The malicious code wasn’t in the repo at all — the setup script fetched it at runtime from a DNS record. Static scan had nothing to catch.
The catch with SKILLDETONATE is speed — a couple of minutes per skill vs. a scanner’s few seconds. But it runs once, before a skill goes live. And the paper’s still a preprint. Code has been released.
