AI Skill Scanners Bypassed by Simple Tricks, Trail of Bits Finds
Trail of Bits demonstrated that public AI skill marketplaces are rife with malicious skills that can evade all major scanners—including ClawHub, Cisco, and skills.sh—using trivial tricks like adding 100k newlines. The researchers urge developers to avoid public skill stores, highlighting the need for stronger, dynamic defenses against skill‑based attacks.