All posts
Unproven Execution

SkillCloak — Skill Scanners Aren't Authorization Gates

A HKUST framework defeats every skill scanner tested, proving the marketplace gate developers trust cannot authorize what an agent will run

Securityv0 Intelligence Team OWASP: ASI05 sv0 finding: unproven_execution
agent-skills skillcloak unproven-execution clawhub scanner-evasion supply-chain

The Incident

On 2026-07-02, researchers at the Hong Kong University of Science and Technology posted “Cloak and Detonate: Scanner Evasion and Dynamic Detection of Agent Skill Malware” (arXiv 2607.02357). The paper introduces SkillCloak, an evasion framework that keeps the malicious behavior of an AI-agent skill intact while defeating the static scanners that skill marketplaces use as their install-time gate. Coverage broke across The Hacker News, cybersecuritynews.com, and GBHackers on 2026-07-06.

Two techniques compose the framework. Structural Obfuscation rewrites concrete indicators — shell commands, URLs, and credential-touching strings — into semantically equivalent forms that scanners’ regex rules and LLM judges no longer recognise. Self-Extracting Skill Packing hides the malicious payload outside the scanner’s observable scope — ignored directories, encoded resource blobs, archived files — and reconstructs it only when the agent executes the skill. Evaluated against 1,613 real malicious skills sourced from ClawHub and eight independent scanners, Self-Extracting Skill Packing bypassed every scanner in the panel more than 90 percent of the time. The authors also propose SkillDetonate, a behavior-centric runtime auditor they claim catches 97 percent of attacks at a 2 percent false-positive rate.

The attack is already live at that surface. In February 2026 the ClawHavoc campaign flooded ClawHub with malicious skills — Koi Security’s Oren Yomtov disclosed 341, Antiy CERT later enumerated 1,184 packages across 12 author IDs, 677 tied to a single author. ClawHub added VirusTotal scanning and rolled out an NVIDIA SkillSpector integration on 2026-06-01 — mitigations that assume static analysis will catch the next round. cybersecuritynews.com and GBHackers name Claude Code and OpenAI Codex among the affected agent hosts.

MITRE ATT&CK coverage: T1587 (Develop Capabilities), T1588.001 (Malware), T1027 (Obfuscated Files or Information), T1140 (Deobfuscate/Decode Files).

The Authority Path That Failed

The identity carrying execution authority at the moment of failure is the AI coding agent’s session — Claude Code, OpenAI Codex, or any host that treats a marketplace skill as trusted code. That session inherits the developer’s whole workstation: filesystem, shell, environment variables, saved credentials in ~/.aws and ~/.config, git tokens, and outbound network. Its held scope is the entire user identity. A pdf-summarizer skill’s intended exercised scope is narrow — read a PDF, write a summary — and nothing beyond that.

The trust anchor that failed first is the install-time static scanner. The marketplace’s gate is a supply-chain-time proxy for developer authorization: we scanned it, so you didn’t have to. SkillCloak targets exactly that anchor. Because there is no per-skill scope declaration, no runtime permission prompt for the shell or credential surfaces the skill will touch, and no per-tool consent gate the operator can inspect, an installed skill exercises the full held scope of the agent session the moment it runs. The gap between held and exercised authority was never bounded by the marketplace — it was assumed away.

SecurityV0 Perspective

This is unproven_execution at supply-chain time. The failure shape is the same one the Langflow CSV Agent with Python REPL reference case named: a framework attaches an execution capability the deploying operator never affirmatively authorized. Here the framework is the agent host, the capability is arbitrary shell and credential access, and the operator’s proxy for authorization was a scanner the researchers just proved unreliable at scale.

The evidence pack SecurityV0 would produce, per installed skill, names three things. First, which agent session holds the skill and which non-human identities — git PATs, cloud CLI profiles, package-registry tokens — the session inherits and would forward. Second, what runtime scopes the skill actually exercises: network egress, filesystem paths, subprocess spawns, versus what its declared purpose implies. Third, which developer machine and which skill first exercised a scope its declared purpose did not require. The pre-exfiltration question the pack answers is which of your developers’ agents install skills from a marketplace whose gating is static analysis, and which non-human identities are reachable from those sessions. The post-exfiltration forensic question is which skill on which host reached which credential and when.

What To Do

  • Treat every installed skill as untrusted code, regardless of scanner verdict. A green mark from ClawScan, VirusTotal, or an LLM judge is a hypothesis, not a grant of authority — one that failed against 1,613 skills at rates above 90 percent. Require a per-skill scope declaration the operator sees before install and treat any undeclared scope as a policy violation.
  • Enumerate the non-human identities each agent session inherits. Before granting an agent skill install rights, list every git token, cloud CLI profile, and package-registry credential the session process will hold. Move credentials the skill’s declared purpose does not require into a separate identity the agent process cannot read.
  • Run installed skills under behavior detonation, not static verification alone. The paper’s proposed SkillDetonate — sandboxed execution with OS-level read, write, and egress observation — is one shape of the fix. Wire the same observation into your CI so a skill whose runtime behavior exceeds its declared scope fails the pull request before it reaches a developer machine.
  • Cut the marketplace’s install-time gate off the critical trust path. Point agent hosts at a private mirror where each skill is republished only after a per-scope allowlist review and a signed manifest. The marketplace scanner becomes a hint, not a control.
  • Deny outbound network by default from agent sessions. Every SkillCloak variant assumes credential exfiltration will eventually reach an attacker endpoint. An egress allowlist scoped to what each skill’s declared purpose requires converts the credential-harvest phase into a policy violation the host will refuse before an attacker sees a byte.

Sources

All posts