The sorry state of skill distribution
Summary: Trail of Bits researchers bypassed ClawHub's malicious skill detector, Cisco's agent skill scanner, and all three scanners integrated into skills.sh, building three of four malicious skills in under an hour using standard tricks and inspection of the scanner source code. The attacks included prepending 100,000 newlines to evade ClawHub's truncating scanner, hiding a malicious script inside a .docx ZIP archive, poisoning .pyc bytecode in a formatting skill, and using rhetorical prompt injection to convince Cisco's Claude Sonnet 4.6-backed analyzer that an attacker-controlled npm and yarn registry was benign.
Key Takeaway: Skill scanners are static targets, so an adversary gets unlimited attempts to tweak an attack until it slips through - and the researchers note that Anthropic's own official MS Office skills use LD_PRELOAD to patch in a binary, a technique the scanner treats as acceptable.
Read the original at Trail of Bits Blog ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026