ClawHub, Cisco, and Vercel Skill Detection Tools Evaded by Malicious Uploads

Security researchers have shown that AI skill security scanners from ClawHub, Cisco, and Vercel’s skills.sh can be reliably bypassed using simple techniques, raising serious concerns about agentic AI supply chain defenses.

In tests conducted by Trail of Bits, multiple malicious skills designed to exfiltrate data, hijack agents, or execute arbitrary code were successfully uploaded and passed as safe by all evaluated scanners.

The work focused on ClawHub’s VirusTotal-backed scanning pipeline, Cisco’s open-source skill-scanner, and the Gen, Socket, and Snyk integrations used by skills.sh.

Detection Tools Evaded

The researchers underline that the core issue is structural, not just a matter of weak signatures or immature rules. Public skill marketplaces now mirror traditional package ecosystems, but with a broader attack surface that combines code, configuration, and natural-language prompts.

Skills can hide malicious behavior in SKILL.MD instructions, embedded scripts, binary artifacts, or even multimodal content, making static analysis and LLM-based classification fragile and easy to game. Because scanners are static targets, adversaries can iteratively test and refine payloads until they land on a variant that passes all checks.

On ClawHub, Trail of Bits demonstrated a trivial bypass by prepending roughly 100,000 newline characters before the malicious logic in a skill file. OpenClaw’s scanning harness truncates oversized content for its guard-model prompt, causing the malicious section to fall outside the inspected region.

The integrated VirusTotal / Code Insight path, which uses Gemini 3 Flash under the hood, also failed to classify the skill as malicious. The attack highlights how context-window and truncation strategies, adopted to control cost and latency, can become blind spots for attackers to exploit.

When assessing skills.sh and Cisco’s skill-scanner, the researchers escalated to more complex techniques leveraging arbitrary Git repositories and binary payloads. One “context-loader” skill, as documented in SKILL.MD instructed the agent to read real instructions from a .docx file, which is actually a ZIP archive containing XML and an embedded shell script payload.

The scanners largely treated the document as opaque and failed to connect the indirection to the hidden script. Another “simple-formatter” skill shipped apparently benign Python source code but paired it with a poisoned .pyc file that harvested environment variables for later exfiltration.

Platform / tool	Scanning approach (high level)	Bypass technique used by researchers	Outcome of scan on malicious skill
ClawHub (OpenClaw)	VirusTotal integration plus LLM-based guard model with file truncation for context control	Prepending ~100,000 newlines so malicious code sits beyond the truncated region	Malicious content ignored; skill passed as safe in UI
Vercel skills.sh	Integrations with Gen Agent Trust Hub, Socket, and Snyk for repo-based scanning	Malicious logic hidden in .docx ZIP payload and poisoned .pyc bytecode	All scanners reported the skills as safe
Cisco skill-scanner	Multi-engine static + LLM analyzer with configurable policies	Ignoring .pyc internals and being misled by “corporate registry” prompt framing	Marked malicious skills as low risk and overall safe

Neither skills.Sh’s integrations nor Cisco’s engines inspected the bytecode closely enough to spot the discrepancy between source and compiled behavior.

Trail of Bits also showcased a prompt-injection-style attack in a “dev-env-setup” skill that configured npm and yarn to use an attacker-controlled registry, framed as an internal corporate mirror.

The SKILL.md and inline comments were carefully written to sound like standard enterprise tooling and AppSec-approved configuration, specifically nudging the LLM analyzers to treat the changes as low risk.

Cisco’s scanner, even when backed by a strong model like Claude Sonnet 4.6, surfaced only low-severity findings and ultimately marked the skill as safe, focusing more on potential exposure of “internal” URLs than on the registry itself as a malicious control point.

Cisco has since accepted a pull request from the researchers that adds strict spec validation and broader language support, including JavaScript and TypeScript scanning. However, these improvements do not address prompt injection or the long tail of languages, formats, and binary artifacts that skills can rely on.

Trail of Bits further noted that even legitimate skills from trusted vendors can look highly suspicious, such as Anthropic’s MS Office skills using LD_PRELOAD tricks to work around sandbox socket restrictions, which current scanners struggle to classify confidently.

The researchers conclude that organizations should not outsource trust decisions to automated skill scanners or public marketplaces. Instead, they recommend curated internal skill registries, strict control over who can introduce or update skills, version pinning, and treating public skills as untrusted code by default.

Until the ecosystem matures, agent operators are urged to keep the skill attack surface small, avoid one-click installs from public hubs like ClawHub or skills.sh in sensitive environments, and assume that motivated attackers can and will bypass current AI skill detection tools.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.