Recent research reveals a critical supply-chain vulnerability in Large Language Model (LLM) coding agents, where malicious third-party skills easily bypass current security scanners.
By using advanced evasion techniques like Self-Extracting Skill Packing, attackers can preserve their malicious payloads while hiding them from static analysis, highlighting the urgent need for runtime defense mechanisms.
LLM coding agents, such as Claude Code and OpenAI Codex, increasingly rely on third-party agent skills to acquire new capabilities.
These skills are distributed as modular packages containing natural-language instructions, executable scripts, and auxiliary resources.
Because these skills execute with the agent’s full inherited privileges, they introduce a massive software supply-chain attack surface.
Threat actors can abuse these permissions to perform security-sensitive actions, including credential theft, source code exfiltration, and the installation of backdoors.
For example, the recent ClawHavoc campaign successfully planted over 300 malicious skills on a public marketplace to silently harvest victim credentials, SSH keys, and cryptocurrency wallets.
Skill Malware Evades Scanners
To combat these threats, the industry heavily relies on static skill scanners that use pattern matching, regex rules, or LLM-as-judge analysis to audit skills before installation.
However, a new evasion framework, SKILLCLOAK, demonstrates that these static defenses are highly vulnerable to payload-preserving evasions.
Attackers do not have to expose their malicious payloads in the exact format the scanner expects. Instead, they can keep the attack semantics entirely intact while heavily transforming their visible form to bypass detection.
SKILLCLOAK achieves this through two highly effective strategies. The first strategy, Structural Obfuscation, rewrites visible payload indicators into semantically equivalent forms.
It minimally perturbs the skill’s structure, rewriting malicious shell commands or credential paths so that static rules no longer trigger.
The second, more dangerous strategy is Self-Extracting Skill (SFS) Packing. SFS Packing hides the malicious components outside the scanner’s observable scope, such as in ignored directories or encoded resource blobs.
The payload is only restored and unpacked during actual agent execution. Across an adversarial study of 1,613 in-the-wild malicious skills, SFS Packing successfully bypassed every tested static scanner at a rate of over 90%.
The failure of appearance-based static auditing has motivated a shift toward behavior-centric runtime defenses.
Because evasive malware must eventually produce observable behaviors to achieve its malicious objectives, security researchers have proposed SKILLDETONATE.
This dynamic runtime auditor executes suspicious agent skills within a controlled sandbox environment.
Instead of relying on install-time appearance, it detects malicious effects by looking at operating system boundary information-flow evidence, arxiv said.
SKILLDETONATE relies on two novel designs to track malware that traditional sandbox syscall monitors cannot natively follow.
The first design is On-Demand Closure Lift, which dynamically captures and executes the natural-language instructions that a skill materializes during execution.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
 coding agents, where malicious){kind=link}