HKUST Researchers Detail SkillCloak, a Method to Slip Malicious AI-Agent Skills Past Scanners

A research team at the Hong Kong University of Science and Technology (HKUST) has unveiled SKILLCLOAK, an evasion framework that hides malicious "skills" for AI agents from static scanners. Using a self-extracting packing trick, it slipped past all eight tested static scanners more than 90% of the time. The paper, "Cloak and Detonate: Scanner Evasion and Dynamic Detection of Agent Skill Malware," was posted to arXiv on July 2, 2026, and detailed by The Hacker News on July 6.