Malicious AI Coding‑Agent Skills Evade Scanners, Enabling Credential Theft and Backdoors
What Happened — Researchers discovered that “agent skills” – plug‑in bundles used by AI coding assistants such as Claude Code and OpenAI Codex – can be weaponised. A campaign named ClawHavoc uploaded >300 malicious skills to a public marketplace. Using a new evasion framework called SkillCloak, the attackers rewrote token strings and hid payloads in scanner‑ignored directories, bypassing 90 %+ of existing static and hybrid skill‑scanners while still executing the malicious payload at runtime.
Why It Matters for Compliance & Audit Readiness
- The scenario is a classic third‑party supply‑chain risk: unvetted code from an external marketplace runs with the same privileges as the AI agent, exposing credentials, source code, and crypto wallets.
- SOC 2 vendor‑management controls (CC6.1, CC6.2) require continuous monitoring of third‑party components and evidence that security‑tooling (e.g., skill scanners) is effective and regularly validated.
- Verisq’s Vendor Risk capability can automate the collection of scanner results, track remediation of evaded skills, and provide audit‑ready evidence that your organization is exercising due‑diligence over AI‑agent add‑ons.
Who Is Affected
- Technology / SaaS vendors that embed AI coding assistants in developer workflows.
- Enterprises that allow developers to pull AI “skills” from public marketplaces.
Recommended Actions
- Inventory every AI‑agent skill used in your development environment and map them to your vendor‑risk register.
- Augment static skill‑scanners with behavioural sandboxing (e.g., SkillDetonate) and capture the results as continuous compliance evidence.
- Update your SOC 2 vendor‑management policy to require provenance verification and periodic re‑scan of third‑party skill bundles.
Source: Help Net Security – Malicious AI agent skills can slip past the scanners built to stop them
Technical Notes
- Attack vector: malicious “skill” bundles delivered via public AI‑agent marketplaces; evasion via token rewriting and hidden‑directory payloads.
- No CVE; the issue is a supply‑chain abuse of AI‑agent extensibility.
- Impacted data: browser credentials, OS keychain passwords, SSH keys, cryptocurrency wallet seeds.