The Hacker NewsTuesday · July 7, 2026FREE

SkillCloak Lets Malicious AI Agent Skills Evade Static Scanners with Self-Extracting Packing

A new technique called SkillCloak has been detailed by researchers, enabling malicious AI agent skills to bypass static security scanners through self-extracting packing. The approach involves packaging harmful skills in a compressed or encoded form that only extracts and executes when loaded by an AI agent framework, effectively hiding the malicious payload from signature-based detection. This method targets the growing ecosystem of AI agents that can extend their capabilities by installing third-party skills, similar to plugins. The researchers demonstrated that SkillCloak can evade multiple static analysis tools, raising concerns about the security of AI agent platforms that rely on such scanners to vet skills before installation. The technique exploits the trust placed in static scanning as a primary defense, potentially allowing attackers to distribute malicious skills through official or unofficial skill marketplaces without immediate detection.