A new form of malware is successfully bypassing security measures designed to protect popular AI coding assistants like Claude Code and OpenAI Codex. This threat is hidden within ‘agent skills,’ small add-on packages that can evade detection by automated scanners while maintaining their malicious capabilities.
Understanding Agent Skills
Agent skills function similarly to plugins, enabling AI coding agents to acquire new functionalities through simple folders containing plain-language instructions, scripts, and associated files. The ease of creating and distributing these packages has led to rapid growth, with over 40,000 skills available on one marketplace just months after the format’s introduction in late 2025.
This rapid expansion has made agent skills a prime target for malicious actors. Since these skills run with the same level of access as the agent, they can potentially access sensitive developer information such as files, saved passwords, and linked accounts. Attackers have exploited this access to steal browser credentials, SSH keys, and cryptocurrency wallet data by disguising harmful skills as helpful tools.
Research Insights and Techniques
Researchers from Arxiv, in a report shared with Cyber Security News, tested this threat using a tool called SkillCloak to evaluate whether existing scanners could detect cleverly disguised malware. The results were concerning, as disguised malware versions evaded detection by almost all of the eight widely used scanners tested, involving over 1,600 real-world malicious skills.
The evasion techniques hinge on two main strategies. The first, Structural Obfuscation, alters suspicious commands and references in a way that appears harmless to scanners while retaining their malicious intent. The second, known as Self-Extracting Skill Packing, conceals the malicious code in locations ignored by scanners, only reconstructing it when the AI agent runs the skill.
Real-World Implications and Solutions
A real-world campaign named ClawHavoc has already exploited these vulnerabilities by placing hundreds of malicious skills on a public marketplace, resulting in the theft of sensitive information such as saved logins and wallet files. Security experts advise scrutinizing skill setup steps and treating unfamiliar skills cautiously, similar to unknown internet downloads.
To address these vulnerabilities, the researchers developed SkillDetonate, a tool that assesses skills based on behavior rather than appearance. By running skills in a sandbox environment and observing real-time file access, network calls, and data movement, this approach has proven effective in identifying most malicious skills, even those bypassing traditional static scanners.
The overarching lesson for users of AI coding tools is the importance of thorough skill evaluation. While checking a skill’s code is still relevant, it is no longer sufficient. Running unfamiliar skills in isolated environments and monitoring for unusual activity are now critical practices to ensure security.
