The security industry's answer to risky AI tooling has been the same as always: scan it. A new study says the scanners are easier to fool than anyone would like.

Researchers at the Hong Kong University of Science and Technology described a technique they call SkillCloak, which hides malicious add-on "skills" for AI coding agents from the static scanners meant to catch them, as reported by The Hacker News. A few simple changes, including a self-extracting packing trick, were enough to slip malware past detection while leaving it fully functional. The skill looks clean to the scanner and behaves maliciously once loaded.

This matters because skills are becoming the plugin economy of AI agents, small packages of capability that developers drop in to extend what an agent can do, often from third parties and often with little scrutiny. It is the browser-extension and npm-package story all over again, with the same trust-by-default reflex, except the thing you are extending can now read your code and run commands. A scanner that can be evaded with a packing trick is a false sense of security bolted onto a fast-moving supply chain.

The takeaway is not to abandon scanning but to stop treating it as sufficient. Vet the source of any agent skill the way you would a dependency, prefer skills you can actually read, and assume a clean static scan is a starting point, not a verdict. When the defense is a scanner and the attacker is optimizing to beat it, the only durable check is watching what the thing actually does.

Sources: The Hacker News, with research from the Hong Kong University of Science and Technology.