SKILLCLOAK and SKILLDETONATE expose AI coding-agent skill scanner evasion with runtime-packed malware
Technical Analysis
Summary
Hide ▲
Show ▼
SKILLCLOAK shows that malicious AI coding-agent skills can be rewritten to evade static scanners while still executing, exposing credentials, source code, and terminal access to hidden payloads. The same research introduces SKILLDETONATE, a runtime checker that inspects behavior instead of appearance and catches most disguised skills the scanners miss. Tests across eight scanners and 1,613 malicious skills from ClawHub found the packing trick evaded detection more than 90% of the time. The result shifts trust from install-time file review to runtime observation.
Related Happenings
Agent data injection proof-of-concept attacks expose trusted-data flaws in AI agents
Technical Analysis
H score25
First: 16.07.2026 14:32
Last: 16.07.2026 14:32
Sources 1
About this happening:
Researchers disclosed agent data injection (ADI), a new attack class that can make shipping AI agents misclick, run attacker commands, and trust fake history across web and co...
Agent data injection proof-of-concept attacks expose trusted-data flaws in AI agents
Technical AnalysisAbout this happening: Researchers disclosed agent data injection (ADI), a new attack class that can make shipping AI agents misclick, run attacker commands, and trust fake history across web and co...
Ghostcommit PNG-embedded prompt injection against AI code reviewers
Technical Analysis
H score25
First: 11.07.2026 12:03
Last: 11.07.2026 12:03
Sources 1
About this happening:
Researchers demonstrated Ghostcommit, a PNG-embedded prompt-injection technique that can bypass AI code review and leak .env secrets into committed source. The pay...
Ghostcommit PNG-embedded prompt injection against AI code reviewers
Technical AnalysisAbout this happening: Researchers demonstrated Ghostcommit, a PNG-embedded prompt-injection technique that can bypass AI code review and leak .env secrets into committed source. The pay...
Prompt-injection proof-of-concept enables silent RCE in Claude Code and Codex
Technical Analysis
H score28
First: 10.07.2026 16:45
Last: 10.07.2026 16:45
Sources 1
About this happening:
Researchers demonstrated a proof-of-concept exploit that can force remote code execution in Anthropic’s Claude Code and OpenAI’s Codex, exposing a trust-boundary f...
Prompt-injection proof-of-concept enables silent RCE in Claude Code and Codex
Technical AnalysisAbout this happening: Researchers demonstrated a proof-of-concept exploit that can force remote code execution in Anthropic’s Claude Code and OpenAI’s Codex, exposing a trust-boundary f...
AI coding assistants GhostApproval symlink security flaw
Vulnerability
H score22
First: 09.07.2026 07:27
Last: 09.07.2026 07:27
Sources 1
About this happening:
A July 8 disclosure identified GhostApproval, a symlink flaw in six AI coding assistants that can redirect approved writes into ~/.ssh/authorized_keys or ~/....
AI coding assistants GhostApproval symlink security flaw
VulnerabilityAbout this happening: A July 8 disclosure identified GhostApproval, a symlink flaw in six AI coding assistants that can redirect approved writes into ~/.ssh/authorized_keys or ~/....
Defensive guidance for splitting behavioral detections around AI coding agents on Windows endpoints
Defensive Guidance
H score28
First: 08.07.2026 20:02
Last: 08.07.2026 20:02
Sources 1
About this happening:
AI coding agents on Windows endpoints are triggering attacker-style detections, forcing defenders to separate benign automation from real credential theft risk. A June 2...
Defensive guidance for splitting behavioral detections around AI coding agents on Windows endpoints
Defensive GuidanceAbout this happening: AI coding agents on Windows endpoints are triggering attacker-style detections, forcing defenders to separate benign automation from real credential theft risk. A June 2...
Timeline
-
06.07.2026 09:33 2 articles · 13d ago
HKUST researchers show malicious AI agent skills can evade static scanners
Technical Analysis UpdateResearchers at the Hong Kong University of Science and Technology showed that malicious AI coding-agent skills can evade static scanners by using SKILLCLOAK to rewrite giveaway bytes, split flagged commands across newlines, or hide payloads in skipped directories such as .git/ while preserving execution. The same work introduces SKILLDETONATE, a runtime sandbox checker that watches file access and data flow instead of file appearance; the report says the packing trick evaded every tested scanner more than 90% of the time across eight scanners and 1,613 malicious ClawHub skills, while SKILLDETONATE caught 97% of attacks in controlled tests and 87% of real-world malicious skills.
Show sources
- SkillCloak Lets Malicious AI Agent Skills Evade Static Scanners with Self-Extracting Packing — thehackernews.com — 06.07.2026 09:33
- SkillCloak Lets Malicious AI Agent Skills Evade Static Scanners with Self-Extracting Packing — thehackernews.com — 06.07.2026 09:33