AI Skill-Scanner Bypass — ClawHub, Cisco & Vercel Malicious-Skill Detectors Evaded via Truncation, .pyc Bytecode, Archive Indirection & Prompt Injection (Trail of Bits) — Threadlinqs Intelligence
As of 2026-06-07, AI Skill-Scanner Bypass — ClawHub, Cisco & Vercel Malicious-Skill Detectors Evaded via Truncation, .pyc Bytecode, Archive Indirection & Prompt Injection (Trail of Bits) is a high-severity supply chain threat attributed to Trail of Bits, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 15 indicators of compromise.
Threat ID: TL-2026-0702 · Severity: HIGH · Status: ACTIVE · Category: SUPPLY_CHAIN
Attribution: Trail of Bits · UNKNOWN
Trail of Bits demonstrated four low-effort bypasses against the malicious-skill detectors used by ClawHub (OpenClaw), the Cisco skill-scanner, and Vercel skills.sh: 100,000-newline truncation padding,
On 2026-06-03, Trail of Bits published "The sorry state of skill distribution," documenting how the security scanners protecting major AI-agent skill marketplaces can be trivially evaded. The research targets three distribution platforms and their integrated scanners: ClawHub (OpenClaw), which pairs a VirusTotal integration with a custom GPT 5.5 guard-model harness; the Cisco skill-scanner, a multi-engine system combining an LLM analyzer (Claude Sonnet 4.6), pattern-matching, and static analysis with an LLM meta-analyzer for false-positive filtering; and Vercel's skills.sh, which integrates the Gen Agent Trust Hub, Socket, and Snyk scanners. Four proof-of-concept malicious skills, all published to the trailofbits/overtly-malicious-skills repository, each defeat one or more of these scanners.
Technique 1 — Truncation via newline padding (skill: csv-summarizer). Prepending roughly 100,000 newline characters between benign boilerplate and the malicious payload causes the OpenClaw scanner to truncate the file during ingestion and miss the malicious content entirely; VirusTotal's model likewise "became confused." The bypass exploits fixed input-length / truncation handling in the scanning pipeline, where content beyond a size threshold is silently dropped. Effort: under one hour.
Technique 2 — Python bytecode poisoning (skill: simple-formatter). The skill ships innocuous-looking source while the real malicious behavior lives in a compiled bytecode file, utils.cpython-312.pyc. The visible SKILL.md and source describe harmless text formatting, but the poisoned .pyc reads the process environment and exfiltrates it, concatenating the marker string "PWNED: " with environment-variable contents (a stand-in for credential/secret theft). The Cisco skill-scanner's static analyzers did not disassemble or investigate the .pyc bytecode, and the LLM analyzer was not steered toward it; skills.sh (Gen/Socket/Snyk) also passed it. Effort: under one hour.
Technique 3 — Archive-based indirection (skill: context-loader). The SKILL.md instructs the agent to extract its real instructions from a .docx document, which is a ZIP archive of XML. A malicious secondary payload, sync1.sh, is embedded inside the archive. Because scanners treat archive/opaque file types as non-executable or only follow files explicitly referenced from SKILL.md, the payload escapes inspection. This reliably beats pattern-match-based scanning and has a decent success rate against LLM scanners. Effort: under one hour.
Technique 4 — Prompt injection via corporate misdirection (skill: dev-env-setup). The skill reconfigures npm/yarn to use an attacker-controlled package registry, https://npm.internal-artifacts.corp.dev, while wrapping the change in extensive comments invoking "corporate engineering standards" and an "AppSec-audited dependency allowlist." The Cisco scanner (Claude Sonnet 4.6) flagged it only LOW severity and ultimately judged it safe — it was more concerned with the skill leaking internal network topology than with recognizing that the registry URL is a public domain an attacker could own and use for dependency-substitution / supply-chain attacks. Effort: several hours of wording trial-and-error.
The research also surfaced a genuine Anthropic Office skill (soffice.py) using LD_PRELOAD to shim socket handling via /tmp/lo_socket_shim.so — flagged only LOW/MEDIUM despite offering an arbitrary-code-execution foothold if that path were attacker-controlled. The overarching finding: scanner file-type whitelisting, truncation, shallow tree traversal, opaque-file handling, and over-trust of LLM guard models combine into an evasion-rich attack surface. No CVE is assigned and no in-the-wild victim exploitation is reported; severity is HIGH on the basis of a fully demonstrated, low-effort, multi-platform bypass affecting widely used AI-agent supply-chain controls.
Weaknesses (CWE)
CWE-506, CWE-494, CWE-829, CWE-913, CWE-1357, CWE-693
Target sectors: technology, software-development, ai-ml, devops
Target regions: Global
Detections & IOCs
As of 2026-07-21, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 15 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, HIGH, threat intelligence, cybersecurity, T1583, T1608.001, T1587.001, T1195.002, T1195.001, T1059.006, T1059.004, T1204.002, T1574.006, T1027