November 2nd Research Briefing

Contents

1. Scan Before You Install: 41 vulnerabilities in popular agent skills
2. CyberDual: hidden exploits that get past AI code review
3. SCS: 627 malicious ClawHub skills, found by compiling instructions into code

Scan Before You Install: 41 vulnerabilities in popular agent skills

Scan Before You Install scanned 1,587 agent skills from the 75 most-starred GitHub repositories that ship skills. Three outside analysts confirmed 53 of its 59 findings in 23 repositories, which group into 41 distinct vulnerabilities. In 21 of them, injected content controls the code or commands that a skill runs. Others bypass required approvals, plant instructions that persist into later sessions, write to sensitive directories, or leak data and credentials. The researchers built a proof-of-concept attack for each of the 41 and disclosed the 10 medium- and high-severity cases to maintainers.

This matters because none of these skills was malicious. Their authors made ordinary mistakes (the paper's example is piping an unpinned URL into a shell), while most current scanners look for deliberately harmful skills and check each skill on its own.

The scanner combines deterministic checks (patterns, value flow, install sources, declared capabilities) with an optional LLM review of the instructions, and an LLM verifier must accept each candidate against the source evidence. A composite module links skills through shared files, environment state, and invocations, then looks for untrusted content that reaches a sensitive operation across skill boundaries.

That module found two composite vulnerabilities in the wild. In one, a Claude Code history reader and a Slack sender let a payload stored in an old session trigger unauthorized Slack messages. In the other, two hermes-agent skills sent an OAuth bearer token to an attacker URL in 5 of 12 GPT-5.2-Codex runs. The recommended mitigations blocked the attack in every trial for 47 of 55 findings without breaking the legitimate task.

Authors: Parth A. Gandhi, Avital Aviv, Prasanna N. Wudali, Yuval Elovici, and Asaf Shabtai (paper, pdf).

CyberDual: hidden exploits that get past AI code review

CyberDual asked AI agents to hide an exploitable bug in real maintenance work on 14 C/C++ libraries, from curl to xz, while other agents reviewed the change. Each attack needed a proof of concept that crashes the attacked code under AddressSanitizer but not the original. Across 1,088 valid attacks, the three reviewers caught 85% to 91%. When the attacker spread the bug over real upstream commits, about one attack slot in six still ended with a working exploit after review, and 28 attacks got past all three reviewers.

This matters because projects already let agents review incoming code, and that code can come from another agent. CyberDual scores the result by execution: a grader reruns the attacker's proof of concept on the code that the reviewer leaves, so a confident review report cannot change the outcome.

Reviewers were Claude Code with Sonnet 5 or Opus 4.8, and Codex with GPT-6-Sol. Attacks that survived often looked like the real upstream fix, dropped its regression test, or rewrote a comment. In one 87-commit OpenEXR window, GLM 5.3 edited two real commits that each looked safe, but together they let an index read past a table. GLM 5.3 also produced 13 of the 28 attacks that beat every reviewer.

The failures differ by vendor. Claude reviewers mostly approved the attack, while GPT-6-Sol mostly repaired the wrong code. GPT-6-Sol caught 69% of the attacks that Sonnet 5 missed, so a second reviewer from another vendor is one of the five defenses that the paper proposes. The arena and a leaderboard are public.

Authors: Chenyuan Yang, Hwiwon Lee, Jongseong Kim, Yihan Yang, Dongjun Kim, Yinfang Chen, and Lingming Zhang (paper, pdf, code). Chenyuan Yang: X, GitHub. Hwiwon Lee: X, LinkedIn, GitHub. Lingming Zhang: X, LinkedIn.

SCS: 627 malicious ClawHub skills, found by compiling instructions into code

The Supply-Chain Scanner for Agent Skills (SCS) analyzed a snapshot of 66,157 public ClawHub skills and flagged 2,473 candidates. After dynamic validation and manual review, the researchers confirmed 627 malicious skills. Two publishers account for 88% of them, and by July 2026 the registry had removed all skills from those two, leaving only 23 of the 627 still identifiable.

This matters because a malicious skill can split its behavior between text and code. In the paper's example, a presentation skill's SKILL.md tells the agent to run a bundled backup script on the edited file, and that script uploads the file to a third-party server. Neither the instruction nor the script looks harmful alone.

SCS compiles each natural-language step into a small Python-style intermediate representation built from a limited set of security APIs, such as reading a file or sending an HTTP request. It then builds one program dependence graph for the instructions and one for the bundled code, and connects them into a single cross-domain graph. Trust, sensitivity, and capability labels propagate over that graph, and deterministic rules decide what to report, so the final verdict does not rest on an LLM judgment.

On a hand-checked set of 117 malicious and 117 benign skills, SCS had the highest average accuracy (85.6%), recall (95.2%), and F1 score (86.9%) of the evaluated methods across five LLMs, with 80.2% precision. The instruction compiler translated 92.5% to 94.5% of 400 annotated steps correctly.

Authors: Shiwu Zhao, Baizhu Wang, Guoqiang Zheng, Tingyu Gao, Yuheng Xie, Rujie Chen, Xingchen Chen, Xuezhang Liu, and Qixu Liu (paper, pdf).