A new study finds that static scanners designed to detect malicious add-on skills for AI coding agents can be consistently bypassed using self-extracting packing techniques.
Summary
- Researchers at the Hong Kong University of Science and Technology developed a technique called SkillCloak that hides malicious ‘skills’ for AI coding agents from static scanners.
- The most effective evasion method bypassed every scanner tested more than 90% of the time.
- The attack surface involves add-on skills — third-party extensions that expand what AI coding agents can do — which are increasingly common in developer workflows.
- The same research team built a runtime detection tool that catches most of the evasive samples, suggesting a path toward better defences.
- No corroborating sources are available at this time; findings are based solely on the reported study.
What the research describes
Researchers at the Hong Kong University of Science and Technology have published findings on a technique they call SkillCloak, which uses self-extracting packing to conceal malicious functionality inside add-on skills for AI coding agents. Skills are third-party extensions that expand what an AI agent can do — fetching data, running code, interacting with external services — and they have become a routine part of developer workflows built around tools like coding assistants.
How the evasion works
According to the reported study, the researchers applied several obfuscation approaches to malicious skill packages, with their strongest technique slipping past every scanner tested in more than nine out of ten attempts. The core idea is that static scanners — tools that inspect code without executing it — examine the surface appearance of a package. By packing malicious logic into a self-extracting wrapper, the payload is only revealed at runtime, after the scanner has already cleared the file. The malware itself remains functional; the scanner simply never sees the parts that matter.
The detection side
The research team did not leave the problem without a proposed remedy. They also developed a runtime checker — a tool that examines behaviour as skills execute rather than inspecting static code — which the study indicates catches most of the evasive samples the packing technique produces. This points to a meaningful gap between static and dynamic analysis in the current generation of AI agent security tooling, and suggests that runtime monitoring deserves attention as a complementary control.
Context for AI agent adoption
AI coding agents and the skill ecosystems that extend them are relatively new additions to enterprise software development. Organisations that have adopted these tools have often done so quickly, and the security tooling has not always kept pace. Static scanning of packages and extensions has been a standard first line of defence in software supply chain security for years, and there is a reasonable tendency to assume those controls carry over to new environments. This research suggests that assumption needs revisiting for AI agent skill repositories specifically.
Limitations to note
It is worth being clear about what is not yet known. The source material does not name which specific scanners were tested, how many were included in the study, or which AI agent platforms were in scope. No corroborating sources are available at this stage. The findings come from a single research group, and independent replication has not been reported. That said, the described mechanism — packing to evade static analysis — is a well-established category of evasion in conventional malware, and its application to AI agent skills is a plausible extension of known techniques.
Why it matters
Organisations deploying AI coding agents are expanding their attack surface through skill ecosystems that may not receive the same security scrutiny as traditional software dependencies. If static scanners — the most commonly deployed gatekeeping control for third-party packages — can be bypassed at a rate above 90%, then current tooling provides a weaker assurance than security teams may believe. The risk is compounded by the privileged access many AI agent skills have to code repositories, development pipelines, and external services. CISOs overseeing developer environments need to understand whether their current controls for AI agent extensions rely primarily on static analysis, and whether runtime monitoring is part of their posture.
What to do now
- Audit whether your organisation’s controls for AI agent skills and extensions rely on static scanning alone, and identify gaps in runtime monitoring capability.
- Evaluate whether a runtime behavioural checker — of the kind the researchers describe building — is available or can be developed for your AI agent deployment.
- Review procurement and approval processes for third-party AI agent skills to ensure they receive supply chain scrutiny equivalent to other third-party software dependencies.
- Monitor for further independent research and vendor responses to the SkillCloak findings before drawing final conclusions about your specific tooling.
