Cloak and Detonate: Scanner Evasion and Dynamic Detection of Agent Skill Malware
2026-07-02 • Cryptography and Security
Cryptography and SecuritySoftware Engineering
AI summaryⓘ
The authors studied how coding agents that use third-party plugins can be tricked by hidden malicious actions. They showed that current scanners, which look for suspicious patterns in code, often fail because attackers can disguise harmful actions without changing what they do. To solve this, the authors created SkillDetonate, a tool that watches what the plugins actually do when running, instead of just what they look like, catching most attacks accurately. This behavior-focused approach proved much better at spotting bad actions than existing methods.
LLM coding agentssoftware supply-chain attackstatic skill scannerspattern matchingpayload obfuscationsandbox executioninformation-flow analysistaint trackingfalse positive rateruntime auditing
Authors
Zimo Ji, Congying Xu, Zongjie Li, Yudong Gao, Xin Wei, Shuai Wang, Shing-Chi Cheung
Abstract
LLM coding agents increasingly rely on third-party agent skills from public marketplaces, which execute with the agent's privileges and create a software supply-chain attack surface: a malicious skill can steal credentials, exfiltrate source code, or install backdoors. Existing defenses use static skill scanners based on pattern matching or LLM-as-judge analysis, but it remains unclear whether they withstand adaptive evasions that preserve malicious behavior while changing payload appearance. This paper first presents an adversarial study of existing skill scanners through SkillCloak, a payload-preserving evasion framework that keeps the attack semantics intact while transforming their visible form. SkillCloak uses two complementary strategies: Structural Obfuscation, which rewrites visible payload indicators into semantically equivalent forms, and Self-Extracting Skill (SFS) Packing, which hides malicious components from the install-time view and restores them during agent execution. Across eight scanners and 1,613 in-the-wild malicious skills, SFS Packing bypasses every scanner at over 90%, while Structural Obfuscation bypasses over 80% on most static scanners and reaches 96% on a hybrid scanner, showing that appearance-based auditing is insufficient. Motivated by this finding, we propose SkillDetonate, a behavior-centric runtime auditor that executes skills in a sandbox and detects malicious effects through OS-boundary information-flow evidence rather than install-time appearance. SkillDetonate combines on-demand closure lift, which observes instructions materialized during execution, with marker-based taint analysis, which tracks sensitive-data flows across the agent context, files, processes, and network operations. The results show that SkillDetonate detects 97% of attacks at a 2% false-positive rate and sustains 87% detection on real-world malicious skills.