SkillCloak Lets Malicious AI Agent Skills Evade Static Scanners

Researchers at the Hong Kong University of Science and Technology have shown that malicious add on skills for AI coding agents can slip past nearly every scanner built to catch them, using disguises that leave the underlying malware fully functional.

What skills are and why they matter

Skills are small packages, typically a markdown instruction file paired with a few scripts, that agents such as Claude Code, OpenAI Codex and OpenClaw load to gain new capabilities. Because a skill is just a bundle of files, the same package can run across multiple agents, and it inherits the agent's own access to files, terminal commands and saved credentials. A malicious one can steal credentials, copy source code or install a backdoor, and most public marketplaces offer little vetting of what gets uploaded.

How SKILLCLOAK defeats scanners

The research team's tool, SKILLCLOAK, rewrites a malicious skill so it looks clean to a scanner while behaving identically once installed. A lighter technique swaps flagged characters for lookalikes from another alphabet or splits a suspicious command across a line break, breaking the pattern a scanner searches for without changing what the command actually does. A heavier technique, described as self extracting packing, hides the entire payload inside a directory scanners typically skip, such as .git, behind a decoder that only rebuilds the skill once the agent runs it.

Across eight scanners tested against 1,613 real malicious skills pulled from the ClawHub marketplace, the packing technique evaded every scanner more than 90% of the time, and most more than 99% of the time. The lighter rewriting technique still cleared 80% or more on most scanners tested.

A runtime alternative

Since appearance can be faked so easily, the researchers propose judging skills by behaviour instead. Their second tool, SKILLDETONATE, runs a skill inside a sandbox and monitors what it actually does at the operating system level, tracking where sensitive data flows rather than relying on how the code looks. In controlled testing it caught 97% of attacks while incorrectly flagging only 2% of safe skills, and it held up even against cloaked payloads. Against real world malicious skills it caught 87%, compared with the strongest scanner tested, built by Cisco, which caught 99% of real world skills before cloaking and roughly 10% afterwards.

This is already happening

Public marketplaces already contain confirmed malicious skills that existing scanners are not catching. Bitdefender reportedly found that around 17% of skills checked on one marketplace carried hidden malicious code, and a separate campaign tracked by Koi Security grew from 341 malicious skills to 824 as the marketplace expanded. Some evasive skills found still live on ClawHub used tricks matching the research directly, including one that padded its file with 22 megabytes of filler data specifically to slip past a scanner's size limit.

What GCC enterprises using AI coding agents should do

Security teams across the Gulf adopting AI coding assistants should treat a scanner pass as a starting point rather than a guarantee. Practical steps include watching what a skill actually touches at runtime rather than only how it looks on submission, restricting agent access to the minimum required for a task, and avoiding running agents on machines that hold credentials or data worth stealing. Static scanning remains useful as a first filter, but the research makes clear it cannot be the last line of defence.