The sorry state of skill distribution

What it is

A Trail of Bits post reporting successful bypasses of every AI-agent "skill scanner" the authors tested: OpenClaw's ClawHub detector, Cisco's open-source skill-scanner, and all three services behind Vercel's skills.sh (Gen Agent Trust Hub, Socket, Snyk). Proof-of-concept skills live in trailofbits/overtly-malicious-skills. Three of the four bypasses took under an hour to build after reading the scanner source.

How it works

The central claim is structural, not incidental: because these scanners are static analyzers, an attacker gets "unlimited bites at the apple" — inspect the (often open-source) scanner, tweak, resubmit until something passes. Two concrete techniques:

• Truncation/confusion: prepending 100,000 newlines between benign boilerplate and malicious code. ClawHub's scanner truncated the file and missed the payload; VirusTotal's model got confused. The long scroll is easy to miss in the web UI.
• Archive indirection: a SKILL.md tells the agent to extract "instructions" from a .docx — really a ZIP of XML — that instead triggers a malicious sync1.sh script. This works against scanners that accept arbitrary git repos.

The distinction between channels is the load-bearing detail the summary omits:

flowchart TD
    A[Skill distribution] --> B[ZIP out-of-band]
    A --> C[Curated marketplace<br/>anthropics/skills]
    A --> D[Public marketplace<br/>skills.sh, clawhub.ai]
    B --> E[Procedural controls possible]
    C --> E
    D --> F[One-click install,<br/>relies on scanners]
    F --> G[Scanners bypassed]

Preconditions / Affected

Matters if you install skills from public one-click marketplaces (skills.sh, ClawHub) or otherwise trust these scanners as a gate. The archive-based attack requires a channel that permits binaries/archives — so it hits skills.sh and Cisco (arbitrary git repos) but not ClawHub, which whitelists file types and forbids binaries and archives.

What to do

The page names no patch. Actionable takeaways:

• Do not treat scanner "safe" verdicts on public marketplaces as trustworthy.
• Prefer channels with procedural controls — out-of-band ZIPs with vetted provenance, or curated marketplaces (anthropics/skills, trailofbits/skills-curated) — over one-click public installs.
• OpenClaw's file-type whitelist (no binaries/archives) is cited as a meaningful, functionality-preserving hardening worth emulating.
• Cisco merged Trail of Bits' hardening changes; the underlying static-scan weakness remains.

Caveats

This is the vendor's own disclosure of self-built PoCs, not third-party reproduction. The fetched text cuts off mid-sentence during the second (skills.sh/Cisco) bypass, so the full details of that attack and any remaining fixes are not captured here. Bypasses reflect the scanner versions tested at publication; specific truncation limits may since be patched.