Loading story…
Researchers at the Hong Kong University of Science and Technology reported that third-party skills for LLM coding agents can be turned into malware that slips past current marketplace screening. In a paper titled "Cloak and Detonate: Scanner Evasion and Dynamic Detection of Agent Skill Malware," they showed that their SkillCloak framework preserves malicious behavior while changing how payloads appear to static scanners, using structural obfuscation and self-extracting skill packing. Testing on 1,613 malicious skills from ClawHub found that self-extracting packing bypassed all eight evaluated scanners more than 90% of the time, while structural obfuscation also defeated most tools at high rates.
The researchers said the findings expose a broader trust gap in AI-agent ecosystems because harmful behavior often appears only during execution, not during static review. To counter that weakness, they introduced SkillDetonate, a sandboxed runtime auditing system that monitors operating-system-level behavior and tracks sensitive data flows across files, processes, network activity, and agent context. In controlled tests, SkillDetonate detected 97% of attacks at a 2% false-positive rate and maintained 87% detection on real-world malicious skills, reinforcing calls for runtime behavioral checks alongside marketplace scanning for agent skills and related tooling.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
The same research introduced SkillDetonate, a sandboxed behavioral auditing system for agent skills that monitors OS-level behavior and information flows at runtime. The paper reports 97% attack detection at a 2% false-positive rate and 87% detection on real-world malicious skills.
Researchers from the Hong Kong University of Science and Technology described SkillCloak, a framework that preserves malicious agent-skill behavior while using structural obfuscation and self-extracting packing to evade static detection. In reported testing, self-extracting packing bypassed all eight evaluated scanners more than 90% of the time.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourcecybersecuritynews.com
Open sourcethehackernews.com
Open sourcearxiv.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A researcher demonstrated that a fake AI agent skill called **`brand-landingpage`** could pass marketplace security checks and spread widely by exploiting a blind spot in how agent skills are reviewed. The skill offered legitimate landing-page functionality, was promoted through open marketplaces, GitHub repositories, and social media, and was reportedly installed by about **26,000 AI agents**, including some linked to enterprise accounts. According to the reports, the package itself appeared benign and cleared tested scanners because the harmful behavior was not embedded in the submitted code. Instead, the skill pointed agents to externally hosted documentation that was modified after approval to instruct them to download and execute a script, demonstrating a supply-chain style attack against AI agent ecosystems. In the controlled test, the script only exfiltrated user email addresses, but the researcher said the same technique could enable arbitrary code execution, broader data theft, and persistent access depending on agent privileges. The findings align with prior warnings from other researchers that static scanning misses mutable external links, and they prompted recommendations to inventory installed skills, restrict approved sources, continuously revalidate linked content, pin versions, and enforce least privilege.
Jun 29, 2026
Researchers disclosed **SymJack AI**, an attack technique that abuses symbolic links in repositories to trick AI coding assistants and automated development tools into writing to attacker-chosen destinations. A user may approve what appears to be a harmless file change, while the operating system follows a malicious symlink to alter configuration files and enable later command execution with the victim’s privileges. The technique raises concerns for local developer workstations and for CI/CD systems that automatically process untrusted pull requests, where compromised jobs could expose cloud credentials, deploy keys, and other sensitive secrets. Separate research found that public **AI skill marketplaces** remain vulnerable to simple malicious submissions that evade automated scanning. Trail of Bits reported bypassing multiple skill scanners with proof-of-concept packages that used oversized files, hidden content in `.docx` archives, poisoned `.pyc` bytecode, and prompt-injection-style social engineering to disguise malicious behavior. The findings indicate that both repository-based coding agents and downloadable agent skills can become supply-chain entry points, prompting calls for stricter validation of resolved file paths, tighter controls on configuration writes, monitoring of runtime behavior, review of pull requests that modify agent setup, and the use of curated internal skill sources instead of public marketplaces for sensitive environments.
Jun 29, 2026
Security researchers are warning that *AI agent “Skills”* (markdown/YAML instruction packages that extend agent capabilities) are becoming a **supply-chain risk** due to hidden prompt-injection content that can survive human review. A demonstrated technique uses **invisible Unicode Tag codepoints** embedded in skill files to smuggle instructions that some models interpret as executable guidance, enabling outcomes such as **data exfiltration**, prompt injection, and other malicious behavior when the skill is invoked; a basic scanner was also built to help detect these hidden-instruction patterns. Separate reporting highlighted broader evidence of the same threat pattern across agent ecosystems: Simula Research Laboratory identified **hidden prompt-injection attacks** in a measurable portion of sampled content on a platform referenced as Moltbook, and Cisco researchers documented a malicious agent skill (“**What Would Elon Do?**”) that **exfiltrated data to external servers** while being artificially boosted to appear as a top-ranked skill. Researchers also anticipate the emergence of **self-replicating adversarial prompts** (“prompt worms/viruses”) that could propagate through networks of communicating AI agents, amplifying the impact of compromised skills and poisoned instruction content.
Jun 29, 2026