"SkillCloak" Repacks Malicious AI Agent Skills to Evade Scanners

AI agent skill marketplaces and scanners; cloaked skills tested against Claude Code and OpenAI Codex

SkillCloak preserves a payload's malicious behavior while rewriting its visible structure, using structural obfuscation and self-extracting packing that hides components in scanner-skipped directories such as `.git` and restores them at runtime. Across 8 scanners and 1,613 real malicious ClawHub skills, self-extracting packing evaded every scanner more than 90% of the time (most above 99%) and dropped the best static scanner from about 99% to 10% detection, while cloaked skills still ran under production agents with no measurable loss of function; the authors' runtime detector SkillDetonate caught 97% of synthetic and 87% of real-world cases

Static scanners inspect skills at submission time, but malicious behavior manifests at runtime. Found by the Hong Kong University of Science and Technology