Cisco, Vercel ClawHub Skill Detector Bypassed to Upload Malicious Skills

Key Takeaways

• Security researchers have identified significant vulnerabilities in AI skill scanning platforms developed by ClawHub, Cisco, and Vercel.
• Attackers can easily bypass these detection mechanisms to upload and distribute malicious AI skills through public marketplaces.
• The bypasses exploit weaknesses in static analysis, pattern matching, and LLM-based inspection, often through simple obfuscation or packaging tricks.
• The findings highlight a critical supply chain risk within AI agent ecosystems, where malicious skills can execute arbitrary code and manipulate AI model behavior.
• Enhanced supply chain security practices are recommended, as automated scanning alone is proving insufficient.

AI skill detection systems from prominent vendors including ClawHub, Cisco, and those integrated into Vercel’s platform are susceptible to bypasses, allowing malicious AI skills to be uploaded and propagated through public distribution channels. This vulnerability poses a growing supply chain threat within AI agent ecosystems, where these “skills” function as reusable software components capable of executing code and influencing AI model behavior.

Research conducted by Trail of Bits demonstrates that threat actors can circumvent existing detection mechanisms using straightforward obfuscation and packaging tactics, rather than requiring sophisticated exploitation techniques.

In one instance targeting ClawHub, researchers successfully concealed malicious code by inserting over 100,000 newline characters. This pushed the harmful payload beyond the scanner’s typical inspection window, leading to truncation in the analysis pipeline. Consequently, the malicious logic passed undetected and also confused integrated scanning engines like VirusTotal’s Code Insight.

Skill Check Bypasses Demonstrated Across Platforms

Further testing revealed similar weaknesses in Cisco’s open-source skill scanner and Vercel’s skills.SH integrations. These platforms incorporate a combination of static analysis, pattern matching, and inspection driven by large language models (LLMs). However, Trail of Bits researchers discovered that these defenses could be bypassed when malicious content was embedded in less obvious formats, such as compiled Python bytecode (.pyc) files or archive-based documents like .docx.

One attack scenario showcased a seemingly innocuous text-formatting skill that secretly contained precompiled Python bytecode. While the visible source code appeared benign, the hidden bytecode was designed to extract environment variables, facilitating potential data exfiltration. Because the scanners predominantly focused on readable source files, the malicious payload remained undetected and was incorrectly classified as safe.

Another effective technique utilized indirect execution paths. Researchers created a skill that instructed the AI agent to retrieve its operational logic from a separate document containing a hidden script. This method successfully bypassed both signature-based detection and LLM reasoning, as the malicious behavior was not directly exposed within the primary skill definition.

Trail of Bits also successfully employed prompt injection to manipulate LLM-based scanners. In one example, a skill disguised a malicious package registry configuration as a standard enterprise setup. By framing the behavior as a legitimate corporate requirement, the scanner downgraded the perceived risk to low severity and approved the skill. This occurred despite its inherent potential to redirect dependency installations to infrastructure controlled by attackers.

Limitations and Recommendations

These demonstrated bypasses highlight fundamental limitations in current AI skill scanning methodologies. Static analysis struggles with complex or obscured file formats, while LLM-based systems can be misled by carefully crafted, persuasive, or contextually framed instructions. Additionally, practical constraints such as limited context windows and selective file inspection create significant blind spots that attackers can repeatedly exploit.

The problem is exacerbated by the rapid proliferation of public skill marketplaces, where users can easily install third-party skills with minimal security verification. Unlike more tightly controlled environments, these platforms often prioritize ease of use and rapid deployment over stringent security controls, thereby increasing exposure to malicious uploads.

Trail of Bits researchers conclude that automated scanning alone is insufficient to secure the rapidly evolving AI skill ecosystems. They advocate for the adoption of established supply chain security practices, including the use of curated repositories, strict access controls, and version pinning for dependencies. Until more robust safeguards are developed, organizations are advised to treat all public AI skills as untrusted code and avoid deploying them in sensitive or critical environments.

What You Should Do

• Assume Public Skills are Untrusted: Treat any AI skill obtained from public marketplaces as potentially malicious, especially for sensitive deployments.
• Implement Curated Repositories: Establish and enforce the use of internal, curated repositories for approved AI skills, similar to traditional software package management.
• Apply Strict Access Controls: Limit who can upload, approve, and deploy AI skills within your organization.
• Pin Skill Versions: Use version pinning for all deployed skills to prevent unexpected changes or malicious updates from being automatically introduced.
• Augment Scanners with Manual Review: Do not rely solely on automated scanners. Implement a process for manual security review of critical or new AI skills.
• Monitor Skill Behavior: Implement runtime monitoring for AI agents and their executed skills to detect unusual or unauthorized activities.
• Educate Developers and Users: Raise awareness among developers and users about the risks associated with third-party AI skills and best security practices.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.