Security researchers disclosed SkillCloak, a set of obfuscation techniques that allow malicious extensions for AI coding assistants — including skills and MCP tools designed to extend platforms such as Cursor, GitHub Copilot, and Claude Code — to evade detection by more than 90 percent of the static scanning tools that marketplace operators and developers depend on to verify extension safety. The research reveals a detection gap in the AI agent extension ecosystem that trails conventional software package security by a wide margin.
What SkillCloak Does to AI Agent Skill Packages to Defeat Static Scanning
AI agent skills and Model Context Protocol tools are code packages that expand what an AI assistant can do — granting it access to file systems, terminal execution, web browsing, external API calls, and other capabilities beyond the base language model. A malicious skill that gains installation on a developer’s machine or in an enterprise AI deployment can harvest everything those elevated permissions touch: source code repositories, environment variables, API keys, authentication tokens, and the contents of files the AI assistant is asked to process.
Static scanning tools are the primary defense marketplace operators and developers use to catch malicious packages before installation. SkillCloak defeats this defense by structuring the malicious logic within skill packages in ways that avoid the pattern-matching signatures static scanners use to flag suspicious code. The obfuscated skills retain functional metadata that makes them appear to be legitimate, well-described tools while concealing the malicious payload from automated review.
Which AI Coding Platforms SkillCloak-Obfuscated Skills Can Target
The AI coding assistant market has expanded rapidly, and with it the ecosystem of third-party skills, plugins, and MCP connectors that extend those assistants. Cursor, GitHub Copilot, and Claude Code are among the platforms researchers identified as within scope for SkillCloak-obfuscated malicious skills. The common thread is the Model Context Protocol, a standard for connecting AI assistants to external tools and data sources that has seen broad adoption across the coding assistant market. Any MCP-compatible platform that installs third-party skills from a marketplace or package repository faces exposure to SkillCloak-obfuscated malicious packages if its review process relies on static scanning.
The market positioning of these tools — as productivity aids for software developers — makes the credential and code theft risk particularly acute. Developers whose AI assistant has been compromised through a malicious skill are likely interacting with the tool in exactly the contexts that expose the highest-value assets: coding sessions where API keys appear in environment files, repository access where source code is read and written, and terminal sessions where credentials move through command-line tools.
What Data Malicious SkillCloak-Obfuscated Skills Can Exfiltrate
A malicious skill that successfully evades static scanning and reaches installation can access everything the AI assistant is authorized to touch. For coding assistants with typical deployment permissions, that includes: source code files and directories the assistant is asked to review or modify; environment variables and configuration files that often contain API keys, database credentials, and authentication secrets; the contents of files passed to the assistant as context; and any terminal or shell output produced during an AI-assisted coding session. Skills installed with MCP connectors that have been granted broad filesystem or network access extend the exposure further.
The researchers found that this detection failure rate — more than 90 percent of static scanning tools bypassed — exceeds benchmarks from conventional malware obfuscation research, reflecting the relative immaturity of security tooling built specifically for AI agent extension ecosystems compared to the more established tooling available for traditional software package repositories.
How AI Agent Extension Detection Falls Behind Conventional Software Package Scanning
The gap between detection capability for AI agent skills and detection capability for conventional software packages reflects how quickly the AI assistant ecosystem has grown relative to the security infrastructure built around it. Traditional package repositories such as npm and PyPI have years of accumulated scanner development, abuse pattern history, and moderation expertise. AI agent skill marketplaces are newer, have smaller security teams, and face novel obfuscation techniques specifically designed for their analysis workflows rather than adapted from conventional malware.
Why Sandbox-Based Dynamic Analysis Is the Recommended Alternative to Static Scanning
Researchers recommended sandbox-based dynamic analysis as the defense most likely to catch SkillCloak-obfuscated skills that static scanners miss. Dynamic analysis — executing the skill in an isolated environment and observing what it does — can detect malicious behavior regardless of how the code is structured, because it evaluates actions rather than patterns. Applying the principle of least privilege to MCP connector permissions also limits what a successfully installed malicious skill can access: a skill that only has permission to read a specific directory cannot exfiltrate credentials from environment variables it was never granted access to read.
