SkillCloak Lets Malicious AI Agent Skills Evade Static Scanners with Self-Extracting Packing

Scanners meant to catch malicious add-on "skills" for AI coding agents can be fooled by a few simple changes that leave the malware working, according to a new study from researchers at the Hong Kong University of Science and Technology. Their strongest trick slipped past every scanner tested more than 90% of the time, and the same team built a runtime checker that catches most of the

The article reports Hong Kong University of Science and Technology research showing that SkillCloak, a self-extracting packing technique for AI agent skills, can reliably evade existing static malware scanners for coding agents, with the strongest variant bypassing all tested scanners over 90% of the time.[8] This extends prior evidence that malicious skills are already a real supply chain problem for agent ecosystems like ClawHub, where large-scale scans have found many skills combining traditional malware with prompt injection in their SKILL.md and associated code.[1][2][5] From a CyberSE.AI perspective, this highlights that organizations cannot rely solely on static signature-based scanning for agent skills: they need SBOM-style inventory of all skills, enforce signed and trusted skill sources, and introduce runtime behavioral monitoring and sandboxing for AI agents to catch unpacked payloads, consistent with emerging guidance to treat skills as a critical part of the AI software supply chain.[5][6][10]