Description

claude-skill-antivirus fails to analyze executable files when scanning local skill directories, reading only SKILL.md while ignoring Python source, bytecode, and other artifacts in the scripts directory. Attackers can distribute skills with malicious code in non-manifest files that receive a SAFE verdict with 100/100 trust score despite containing unanalyzed executable payloads.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-02T17:18:05.297Z",
  "pubdate": "2026-09-02T17:18:05.297Z",
  "executiveSummary": "The claude-skill-antivirus scanner exhibits a critical flaw in its ingestion logic, leading to an incomplete security assessment of local skill directories. By exclusively parsing the SKILL.md manifest file while failing to perform static or dynamic analysis on the scripts directory, the tool creates a false sense of security.\nThis vulnerability constitutes an inadequate input validation and file-scanning defect. An attacker can distribute malicious payloads—including Python source code, compiled bytecode, or other executable artifacts—within the scripts subdirectory without triggering detection.\nDespite the presence of harmful executable content, the scanning engine returns a 'SAFE' verdict with a 100/100 trust score. This failure allows malicious skills to be deployed in production environments, potentially leading to unauthorized code execution, data exfiltration, or system compromise. The vulnerability does not require authentication to the scanning tool itself, as the threat is inherent to the ingestion and inspection process of the skill packages. Organizations relying on this tool for security gatekeeping are effectively bypassed, as the scanner ignores the primary attack surface within the package architecture.",
  "technicalDetails": "The root cause of this vulnerability is a restrictive file-parsing implementation within the claude-skill-antivirus scanning module. The engine is hardcoded to validate only the SKILL.md file, operating under the assumption that metadata files represent the total attack surface of a skill. This design overlooks the file system hierarchy defined by the product, specifically failing to traverse or inspect the 'scripts' directory where core functional logic resides.\nThe attack flow commences when a malicious actor crafts a skill package containing a benign SKILL.md file to satisfy the parser, while embedding malicious logic in secondary files such as obfuscated Python scripts (.py) or compiled Python bytecode (.pyc). When the target system executes the claude-skill-antivirus scanner against this directory, the scanner processes the manifest, finds no anomalous content in the text-based metadata, and generates a benign safety report. Because the scanner fails to perform recursive file scanning or file-type identification, the malicious artifacts remain unexamined.\nExploitation is trivial and does not require complex techniques or interaction with the scanner's internals. An attacker simply places the payload in the designated scripts folder. Since the scanner does not inspect these files, it implicitly assigns a maximum trust score of 100/100 to the entire directory, effectively white-listing the malicious code for execution. Once the skill is deployed, the underlying host system treats the unanalyzed files as trusted, allowing the attacker to achieve code execution with the permissions of the skill runner.\nThe absence of deep inspection (e.g., hash-based blacklisting, signature matching for Python obfuscation, or heuristic analysis of binary signatures) ensures that even known malicious patterns pass through the scanner undetected. This vulnerability impacts any system utilizing claude-skill-antivirus as a gatekeeper, as the current architecture lacks the capability to verify the integrity or safety of the actual executable components that define the skill's behavior."
}