Research demo
SkillCloak: self-extracting skill packing evades 8 agent-skill scanners at >90%
AIR-2026-0154 AIR record · 2026-07-skillcloak-scanner-evasion
From the supporting source
A scanner judges a skill by how it looks when it is submitted, but the malicious behavior only shows up once the skill runs, after the scan has passed.thehackernews.com
The record
Disclosed
2026-07-06
Vendor
Anthropic / OpenAI / OpenClaw / Cisco
Product
Claude Code, OpenAI Codex, OpenClaw skill loading; eight skill scanners including Cisco's
Risk domain
Access control and permissions › Privilege escalation
System type
Generative model
Who acted
Agent acted (contested) — the packed skill unpacks and executes under the agent at runtime
Attack surface
Skill / plugin
Autonomy level
Semi-autonomous
Initial vector
Packed payload restored at runtime
Impact type
Arbitrary code execution
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0055 – Unsecured Credentials
- NIST AI RMF
- GOVERN 6.1
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool misuse
- Mitigation
- Apply least-privilege principle; Regular policy audits.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
static skill scanning as a control class
Capability abused
Defense & remediation
Recorded defense
eight static agent-skill scanners
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
academic disclosure; dynamic detection proposed
Taxonomy & references
Curator notes
Research from Hong Kong University of Science and Technology. Two operators: self-extracting packing (>90% bypass on all 8 scanners, >99% on most) and lighter character rewriting - homoglyph swaps and splitting flagged commands across newlines (>80% on most, 96% on one). arXiv preprint 2607.02357 'Cloak and Detonate' listed as the paper; only the news writeup is quoted here.
Supporting sources
Cite as
Enkrypt AI. "SkillCloak: self-extracting skill packing evades 8 agent-skill scanners at >90%". AIR, AIR-2026-0154. https://agentincident.vercel.app/i/AIR-2026-0154/ (accessed 2026-10-19).