How Attackers Hide Payloads in Agent Skills

The New Supply-Chain Threat Hiding in Plain Text

In October 2025, Anthropic introduced the SKILL.md format — plain-text instruction packages that teach coding agents new capabilities. By early 2026, one marketplace had accumulated over 40,000 skills, and daily submissions had jumped from under 50 to more than 500 in a matter of weeks. What nobody built along the way was a security gate.

The result is a supply-chain problem hiding in plain text. Researchers who collected 42,447 skills from two major marketplaces found that 26.1% of 31,132 analyzed skills contain at least one vulnerability, including 13.3% with data-exfiltration behavior. Snyk's separate audit of 3,984 skills found 13.4% carry at least one critical security issue. Publishing a skill requires little more than a SKILL.md file and a week-old GitHub account — no code signing, no review, no sandbox.

The deeper danger is what security researchers call the consent gap. Once you approve a skill, it inherits your agent's full permissions — shell access, file system read/write, credential access, even persistent memory — often without further prompts. As HiddenLayer puts it, trust should be deliberately established, not automatically inherited.

This isn't theoretical. Real campaigns are already running:

• The ClawHavoc campaign flooded a major registry with 341 malicious skills in three days, targeting exchange API keys, SSH credentials, browser passwords, and crypto wallets.
• A skill called "Clawsights" posed as a Claude Code usage leaderboard while using gh auth token to steal the user's GitHub token and exfiltrate it via curl, disguised as a routine usage report.
• One actor produced 54% of confirmed malicious skills through a "factory" of fake integration skills — and payloads wrote themselves into agent memory files so backdoors survived skill removal.

What makes these attacks so effective is that the payload often lives in text a human never reads: HTML comments, YAML frontmatter, base64-encoded commands, even invisible Unicode characters the model interprets but the eye cannot see. Snyk's researchers found that 91% of confirmed malicious skills pair malicious code with prompt injection that primes the agent to accept it.

The vendor line — that users are responsible for running only trusted skills — assumes users can verify what a skill does before running it. Most can't. That's the gap SkillzBench is being built to close: independent security scanning, version pinning, and sandboxed benchmarking for every skill, so trust is earned with evidence rather than granted by default.

If you've installed a skill in the past month, there's roughly a one-in-eight chance it contains a critical flaw. The waitlist is open if you want a trustworthy way to evaluate what your agents are actually running.

The Payload-Hiding Toolkit: Nine Ways Malicious Skills Evade Review

The most dangerous payloads aren't the ones attackers write — they're the ones reviewers never see. Malicious skills rarely announce themselves; they hide in encoding tricks, invisible characters, and metadata the human eye never renders.

1. Base64 obfuscation. Snyk's audit of 3,984 skills found payloads like eval $(echo "..." | base64 -d) decoding to a curl command that exfiltrates ~/.aws/credentials (Snyk's ToxicSkills research). The skill looks like configuration text; the shell sees a credential thief.

2. Invisible Unicode tag codepoints. Characters that appear blank in any text editor are interpreted as instructions by certain models, per Mondoo's analysis. A reviewer approving what they read approves text they cannot perceive.

3. HTML comments. A 312-star code-review skill contained a hidden "SYSTEM OVERRIDE" comment — invisible in rendered documentation — directing the agent to auto-approve "security-exempt" PRs and exfiltrate conversations. 4. YAML frontmatter preapprovals like allowed-tools: Bash(*) grant shell access before any executable logic runs (Datadog Security Labs).

5. External loading and download chains. The payload lives off-file: one script fetches another from GitHub, paste services, or attacker-controlled domains. 6. Password-protected ZIPs defeat automated scanner inspection entirely. 7. Runtime reassembly — SkillCloak's rewriting trick dropped the best static scanner from ~99% to ~10% detection (evasion research).

The final two techniques bypass review structurally rather than visually:

• Dynamic-context (!) commands execute shell commands before the rendered skill reaches the model — "model-level prompt injection defenses never get a chance to intervene."
• Memory-file persistence — ClawHavoc wrote instructions into agent memory so the backdoor survived skill removal.

What unites these techniques is the pairing of code with manipulation. Snyk found 100% of confirmed malicious skills contain malicious code patterns, while 91% simultaneously employ prompt injection that "primes the agent to accept and execute malicious code." This is exactly the threat model driving SkillzBench's pre-launch approach: pinning versions to commit SHAs, sandboxed behavioral benchmarking rather than static review alone, and per-agent loadouts where an agent only sees the skills explicitly chosen for it. Skills, proven.

Why Static Scanning Alone Fails — and What Actually Works

If a skill looks clean on inspection, that tells you almost nothing about what it will do on your machine. Evasion research has turned "just scan it" from a comforting assumption into a measurable failure.

The numbers are stark. In SkillCloak evasion research from HKUST, tested against 1,613 genuine malicious skills, a simple rewriting trick — rewording suspicious command tokens, credential paths, and URLs into equivalent forms the agent reassembles at runtime — dropped the best static scanner from roughly 99% detection to about 10%. The packing trick, which hides a payload in a directory scanners skip and rebuilds it at runtime, evaded every scanner tested more than 90% of the time.

Static scanning still matters — it's fast, cheap, and catches the lazy stuff. Snyk's detectors found malicious code patterns in 100% of confirmed malicious skills and prompt injection in 91%. But the same research shows the blind spots: credential handling flagged at only 63%, secret detection at 32%, and unverifiable dependencies at a dismal 21%. And payloads can simply lie dormant during a one-time scan, activating only under specific conditions.

What holds up under evasion is watching what the skill actually does. The SkillDetonate behavioral approach detonates skills in a sandbox and scored 87% detection on real-world malicious skills — and, critically, stayed steady even when SkillCloak's evasion tricks were applied. The tradeoff is cost: about 2.5 minutes per skill, which is why it complements rather than replaces static analysis.

Don't lean on the model to save you, either. Datadog's analysis of the real-world Clawsights credential stealer found that Claude Opus 4.6 caught it while Opus 4.7 ran it — and dynamic context commands executed even while the model was stating its refusal. Anthropic itself concedes prompt injection is "far from a solved problem."

Defense, then, has to be layered:

• Pin every skill version to a specific commit — no registry offers this today, and auto-upgrades can silently introduce malicious code.
• Run static scanning, knowing its documented evasion limits.
• Detonate skills in a sandbox and compare behavior with and without the skill installed.
• Apply least privilege — an approved skill inherits shell, file, and credential access by default, so control what each agent can see and do.

This layered model is exactly what SkillzBench is building: version pinning to commit SHAs, security scanning, sandboxed benchmarking of every skill with and without it active, and per-agent loadouts so an agent only sees the skills and tools you explicitly chose. Trust should be deliberately established, not automatically inherited — and that takes more than a scanner.

Skills, proven. Join the SkillzBench waitlist to get independent security and benchmark data on agent skills the moment we launch.

Your Defense Playbook: Practical Steps for Teams Running Agents

The good news: the research doesn't just diagnose the problem — it points to a defense playbook that works. The bad news: almost none of it is what teams are doing today.

Start by treating skills as third-party code, not configuration text. Skills execute with full agent privileges — file access, credentials, terminals, network — and natural-language instructions bypass code-level detection entirely, as the academic analysis of 31,132 skills makes clear. That means every skill entering your org deserves the same review rigor as an npm dependency.

Pin versions to commit SHAs. No major registry offers version pinning today, and auto-upgrades can silently introduce malicious code, according to Mondoo's analysis. HiddenLayer's guidance is blunt: approve specific versions, never trust "latest."

Combine static scanning with sandboxed detonation. Static analysis alone is provably insufficient — SkillCloak's rewriting technique dropped the best static scanner from ~99% to ~10% detection, per evasion research covered by Help Net Security. Behavioral detonation held up far better: 87% detection on real-world malicious skills, steady even under evasion.

Apply least privilege, aggressively:

• Use per-agent loadouts so each agent only sees the skills and tools it actually needs — the "consent gap" means approved skills gain persistent permissions without further prompts.
• Set "disableSkillShellExecution": true in managed settings, as Datadog Security Labs recommends, since dynamic-context commands execute before the model ever sees the skill.
• Audit skills entering via project folders, plugins, and --add-dir — they reach trusted sessions without any marketplace install.
• Build an internal approved catalog rather than letting agents pull from public registries ad hoc.

Handle script-bearing skills differently. Skills bundling executable scripts are 2.12× more likely to contain vulnerabilities than instruction-only skills. This is why SkillzBench's launch scope covers instruction-only skills, with script-bearing skills listed link-out only — and why its pipeline pairs SHA-pinned versions, security scanning, and sandboxed benchmarking with per-agent controlled loadouts, so teams can apply exactly this playbook without building it themselves.

The vendor guidance of "only run trusted skills" assumes users can verify what a skill does. Most can't — and you shouldn't have to.