SkillCloak Technique: Bypassing Static Scanners using Self-Extracting Packing for Malicious AI Agent Skills

Researchers developed SkillCloak, a technique that uses self-extracting packing to disguise malicious AI agent skills, successfully evading static scanners. This work emphasizes shifting security focus from static pre-scan checks to runtime behavioral analysis to detect malicious activity.

Scanners meant to catch malicious add-on "skills" for AI coding agents can be fooled by a few simple changes that leave the malware working, according to a new study from researchers at the Hong Kong University of Science and Technology.

Their strongest trick slipped past every scanner tested more than 90% of the time, and the same team built a runtime checker that catches most of the

Read original article