# SkillCloak: New Evasion Technique Defeats AI Agent Security Scanners at 90% Success Rate


Researchers from Hong Kong University of Science and Technology have uncovered a sophisticated evasion technique that allows malicious add-on "skills" for AI coding agents to bypass static security scanners with alarming consistency. The technique, called SkillCloak, uses self-extracting packing and obfuscation methods to evade detection, with the most effective variants slipping past every scanner tested more than 90% of the time. The discovery highlights a critical vulnerability in the emerging AI agent security landscape, where defenders are struggling to keep pace with attackers exploiting the rapid proliferation of AI-powered development tools.


## The Threat


SkillCloak represents a new category of attack vector designed specifically to compromise AI coding agents—increasingly popular tools that automate software development tasks by executing "skills" or plugins provided by developers. These skills can access sensitive environments, execute code, interact with repositories, and perform administrative functions that give attackers broad lateral movement capabilities once injected.


The threat is immediate and practical: attackers can weaponize seemingly legitimate skills, hiding malicious functionality behind layers of obfuscation. A compromised skill might:


  • Steal credentials from development environments or API keys stored locally
  • Inject backdoors into source code repositories during commits
  • Exfiltrate proprietary code to attacker-controlled infrastructure
  • Pivot to internal networks by leveraging the AI agent's access to development machines and CI/CD pipelines
  • Establish persistence through modified build pipelines or infrastructure-as-code templates

    • The critical problem: current security tools designed to scan and validate skills before installation are failing to detect these threats at meaningful scale.


    ## Background and Context


    The rise of AI coding agents has created a new attack surface. Tools like GitHub Copilot, AWS CodeWhisperer, and specialized enterprise AI coding platforms have embedded extensibility through skill or plugin systems. These allow developers—or attackers impersonating developers—to extend agent capabilities with custom code.


    Unlike traditional software supply chain attacks, AI agent compromise happens at a layer that many organizations haven't yet secured. Security teams are still building processes around:


  • Skill vetting and approval workflows (most don't have them)
  • Runtime monitoring of AI agent behavior (nascent to nonexistent)
  • Detection of malicious skill payloads (fragmented tooling)

    • The security industry responded by developing static analysis scanners—tools that examine skill code before execution to identify suspicious patterns. Major vendors including Snyk, Semgrep, and others introduced AI agent skill scanning features. However, the research shows these scanners share predictable detection patterns that attackers can systematically evade.


    ## Technical Details: How SkillCloak Works


    The technique exploits fundamental limitations in static analysis through several layered approaches:


    ### Self-Extracting Packing


    The most effective variant uses runtime code unpacking—storing malicious payloads in compressed or encrypted format that is only decompressed during execution. Static scanners analyzing the skill's source code see only the unpacking routine, not the actual malicious logic. This mirrors tactics used in traditional malware for decades, but the researchers show it's largely undetected in the AI agent context.


    ### Semantic Obfuscation


    SkillCloak applies transformations that preserve functionality while breaking detection signatures:


  • Variable renaming to generic names (a, b, c instead of exfiltrate_token)
  • Control flow flattening that obscures the logical sequence of malicious actions
  • Dead code injection that adds benign operations to dilute suspicious patterns
  • API call redirection that routes dangerous functions through innocent-looking wrappers

    • ### Polymorphic Variants


    The researchers created multiple variants of the same payload, each with unique obfuscation patterns. When tested against multiple scanners, different variants bypassed different tools—suggesting that no single scanner maintains comprehensive coverage.


    ### Evading Heuristic Detection


    Many scanners rely on heuristic scoring (flagging code that "looks suspicious") rather than signature matching. SkillCloak reduces heuristic score through:


  • Intentional code bloat that increases lines of code analyzed
  • Legitimate-looking function names and operations interspersed with malicious logic
  • Distributed payloads across multiple functions to avoid concentration of suspicious patterns

    • The research team also developed a runtime checker that monitors AI agent behavior during skill execution. This approach shows promise—catching most evasion attempts by observing what skills actually *do* rather than what they *look like*.


    ## Who Is at Risk?


    Several groups face immediate exposure:


    | Group | Risk | Why |

    |-------|------|-----|

    | Enterprise AI adopters | Critical | Internal skills may be compromised; insufficient vetting processes |

    | Managed skill marketplaces | High | Malicious skills can poison shared repositories |

    | Open-source contributors | Medium-High | Legitimate developers unaware their skills are compromised |

    | Cloud infrastructure teams | High | Skills with infrastructure access enable lateral movement |

    | Small development teams | High | Minimal security processes around skill adoption |


    ## Implications


    The findings reveal an uncomfortable reality: the security tooling for AI agents lags significantly behind the threat landscape. As organizations rush to adopt AI coding assistants, they're largely blind to the skill layer—a gap that attackers are beginning to exploit.


    Secondary concerns include:


  • False confidence in static analysis tools that claim to catch malicious skills
  • Supply chain complexity that makes skill provenance and integrity difficult to verify
  • Regulatory exposure for organizations handling regulated data through compromised AI agents
  • Acceleration of breaches through CI/CD pipeline compromise enabled by malicious skills

    • ## Recommendations for Defenders


    Organizations deploying AI coding agents should implement layered defense:


    ### Immediate Actions


    1. Audit existing skills - Inventory all skills deployed across coding agents and review their sources

    2. Implement approval workflows - Require skill review before installation; favor skills from trusted vendors

    3. Restrict skill permissions - Use role-based access controls to limit what individual skills can access

    4. Monitor AI agent activity - Log and alert on unusual behavior from deployed skills


    ### Medium-Term Initiatives


    1. Deploy runtime monitoring - Implement behavioral detection alongside static scanning

    2. Version control skills - Treat skills like code; maintain audit trails of changes

    3. Sandbox skill execution - Run skills in isolated environments with limited system access

    4. Security training - Educate developers on skill risks and safe selection practices


    ### Long-Term Strategy


    1. Advocate for secure defaults - Work with AI agent vendors to enable security features by default

    2. Participate in threat intelligence sharing - Join or create communities focused on AI agent security

    3. Invest in detection tooling - Support development of mature runtime monitoring solutions

    4. Establish skill signing standards - Push for cryptographic verification of skill provenance and integrity


    ---


    ## HackWire Analysis


    The SkillCloak research exposes a timing mismatch: static analysis scanners arrived as security theater just as attackers were learning the vulnerability space. The 90%+ evasion rate isn't surprising—it reflects the predictable maturity curve of security tooling. What is notable is how closely this mirrors earlier failures: antivirus vendors claimed "comprehensive detection" in 2005, endpoint tools claimed "predictive" blocking in 2015, and now AI agent security claims "comprehensive skill validation" in 2026.


    The real insight is this: organizations are adopting AI agents faster than they're building security processes around them. A compromised skill has asymmetric impact—it doesn't just steal code, it becomes a trusted component of the build pipeline, enabling backdoor injection, credential theft, and lateral movement all at once. Unlike a traditional software dependency where compromise is usually detected within weeks, a malicious AI agent skill could operate undetected indefinitely because it's expected to execute code and access sensitive systems.


    The runtime monitoring approach the research team demonstrated is the right direction, but it requires organizational discipline: logging, alerting, and response processes that most teams haven't built yet. Until then, the safest posture is skepticism—treat all skills as unvetted until proven otherwise, require explicit approval for elevated operations, and assume that evasion techniques will outpace static scanners by months at a time.


    For security teams already struggling with cloud-native and containerized workloads, AI agent security is arriving as a new frontier with minimal guardrails. The window to build mature defenses before large-scale compromise is closing. — *HackWire Editorial*


    ## Related Coverage


  • Read more in our [Malware](https://www.hackwire.news/category/malware) coverage
  • Cross-reference with [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) and [Supply Chain Security](https://www.hackwire.news/category/supply-chain)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)