SkillCloak Technique Lets Malicious AI Agent Skills Evade Static Scanners with Self-Extracting Packing

Researchers at the Hong Kong University of Science and Technology have developed a technique called SkillCloak that allows malicious AI agent skills to evade static scanners with high success rates. The method uses self-extracting packing and character manipulation to bypass detection, achieving over 90% evasion across eight tested scanners. The team also created a runtime checker, SkillDetonate, that catches 97% of attacks in controlled tests.

Skills are small packages loaded by AI coding agents like Claude Code, OpenAI Codex, and OpenClaw, granting them new capabilities. Malicious skills can steal credentials, copy source code, or install backdoors. Public marketplaces often lack rigorous vetting, making them vulnerable to such attacks.

The SkillCloak tool operates in two ways: a lighter version rewrites suspicious bytes using look-alike characters or line splits, while the heavier method packs the payload into directories scanners skip (e.g., .git/). The packing trick evades scanners over 99% of the time in most cases. The disguise costs attackers little, as cloaked skills function identically to originals.

Real-world evidence shows malicious skills are already prevalent. Bitdefender found 17% of skills on one marketplace contained hidden malicious code, and Koi Security identified 341 skills in a campaign called ClawHavoc. Unit 42 found five evasive skills on ClawHub, including one padded with 22 MB of junk to bypass size caps.

The researchers propose runtime behavior monitoring as a more durable defense, tracking data flows and executing instructions in a sandbox. While slower than static scanning, SkillDetonate catches 87% of real-world malicious skills. The paper recommends hashing skills at scan time, re-checking before each run, and flagging skills with opaque blobs in ignored folders or oversized files.