Malicious AI Coding Skills Are Slipping Past Security Scanners at a 90 Percent Rate, Here Is How

Researchers at the Hong Kong University of Science and Technology built a tool called SKILLCLOAK that rewrites malicious AI agent skills so they look clean to scanners while behaving exactly the same underneath.

Tested against eight scanners and 1,613 real malicious skills pulled from the ClawHub marketplace, the tool’s strongest technique bypassed every scanner more than 90 percent of the time, and most scanners more than 99 percent of the time, according to the researchers’ paper, Cloak and Detonate.

A lighter disguise technique still cleared more than 80 percent of scanners and reached 96 percent against one hybrid scanner. On production agents including Claude Code and OpenAI Codex, the disguised skills performed identically to the original malicious versions, meaning the attacker loses nothing by hiding the payload.

Skills Are Small Installable Packages That Run With the Same Access as the Agent Itself

A skill is typically a Markdown instruction file paired with a few scripts that an AI coding agent loads to gain a new capability. Because a skill is just a bundle of files, the same one can run across different agents including Claude Code, OpenAI Codex, and OpenClaw, as reported by The Hacker News.

Once installed, a skill runs with the agent’s own permissions. That means access to the user’s files, terminal, and saved passwords. A malicious skill can steal credentials, copy source code, or install a backdoor, and most public skill marketplaces accept uploads from strangers with little to no vetting.

The Disguise Works Two Ways, and One of Them Hides the Payload Where Scanners Never Look

The lighter technique, called Structural Obfuscation, rewrites the exact bytes a scanner keys on. It swaps a character for a lookalike from another alphabet, or splits a flagged command across a newline, so the scanner’s pattern match fails while the command still runs unchanged.

The heavier technique, Self-Extracting Skill Packing, moves the entire malicious payload into a directory scanners typically skip, such as .git, hidden behind a harmless-looking decoder. The decoder only rebuilds the payload once the agent actually runs the skill, which is precisely the moment static scanning has already finished.

A Behavior-Based Checker Catches What Scanners Cannot See Before a Skill Runs

Since appearance can be faked, the same research team built SKILLDETONATE, a runtime auditor that executes a skill inside a sandbox and watches what it actually does at the operating system level: what it reads, what it writes, and where it sends data.

In a controlled benchmark, SKILLDETONATE caught 97 percent of attacks while incorrectly flagging only 2 percent of safe skills. Against real-world malicious skills pulled from the wild, it caught 87 percent, a rate the researchers report held steady even when the skills were cloaked. The tradeoff is speed, taking a couple of minutes per skill against a scanner’s few seconds, though it only needs to run once before a skill goes live.

One of the Industry’s Strongest Scanners Dropped From 99 Percent Detection to Roughly 10 Percent

Cisco’s scanner, the strongest of the eight tested in the paper, caught 99 percent of real-world malicious skills before they were cloaked. After SKILLCLOAK’s disguise was applied, that detection rate fell to approximately 10 percent, illustrating that even the best-performing static scanner in the study could not hold up against payload-preserving evasion.

Malicious Skills Already Live on Public Marketplaces Are Using These Exact Tricks Today

Bitdefender found that roughly 17 percent of the skills it examined on one AI agent marketplace carried hidden malicious code, according to Dark Reading. Separately, Koi Security’s audit of the ClawHub marketplace found 341 malicious skills in a single campaign it named ClawHavoc, a number that grew to 824 as the marketplace expanded past 10,700 listings, based on Koi Security’s published research.

Palo Alto Networks’ Unit 42 identified five evasive skills still live on ClawHub despite the marketplace’s built-in scanning. One, named omnicogg, padded its README file with 22 megabytes of junk data specifically to slip past the scanner’s size cap, matching the exact size-padding technique the SkillCloak paper tests. Two of the five delivered Mac password-stealing malware, and two others hijacked the agent’s financial advice output to push affiliate links and manipulate meme-coin launches for profit.

The Same Blind Spot Is Showing Up Outside Skill Marketplaces Entirely

Researchers at Mozilla’s 0DIN team demonstrated that a completely clean GitHub repository, containing no malicious code at all, could still trick Claude Code into opening a reverse shell on a developer’s own machine. The repository shipped a package designed to fail on first run with an error message instructing the user to run an initialization command, which then fetched a malicious payload from a DNS text record controlled entirely by the attacker, as detailed in coverage from DevOps.com.

Because the payload never existed in the repository itself, no static scan or human code review had anything to catch. The malicious instruction only materialized once the agent actually executed the setup script, the same runtime blind spot the SkillCloak research exploits inside skill marketplaces.