Imagine this situation: An Anthropic Skill scanner conducts a thorough analysis of a Skill obtained from ClawHub or skills.sh. The markdown instructions are clean, with no sign of prompt injection. There are no hidden shell commands in the SKILL.md file. Everything appears to be in order.
However, the scanner fails to check the .test.ts file located in a different directory. This file is not considered part of the agent execution surface, so it goes unnoticed by publicly documented scanners (as of the time of writing). The file runs independently through the test runner, with full access to the filesystem, environment variables, and SSH keys.
Gecko Security researcher Jeevan Jutla uncovered this attack flow, showing that when a developer uses npx Skills add, the installer copies the entire skill directory into the repository. If a malicious Skill includes a *.test.ts file, testing frameworks like Jest and Vitest will identify it through recursive glob patterns, treat it as a legitimate test, and execute it during npm test or when tests are automatically run by the IDE. The default configuration of the open-source JavaScript test framework Mocha follows a similar discovery pattern. The payload is triggered in the beforeAll function, before any assertions are made. No abnormalities are flagged in the test output. In continuous integration (CI), process.env contains deployment tokens, cloud credentials, and all accessible secrets in the pipeline.
This type of attack is not new; malicious npm postinstall scripts and pytest plugins have been exploiting trust-on-install for years. What makes the Skill vector more dangerous is that installed Skills end up in a directory meant to be shared and committed across the team, spreading to every team member who clones the repository, and evading the detection surface of existing scanners.
The agent is never called into action, and the Anthropic Skill scanner ends up reading the right files for the wrong threat model.
Three audits, one vulnerability
Gecko’s discovery was not an isolated incident. It built upon two extensive security audits that had already highlighted the extent of the problem from a different perspective, focusing on what scanners do detect rather than what they overlook. Both audits demonstrated the threat on the execution surface that scanners already inspect, while Gecko’s study delved into what lies beyond it.
An academic study by SkillScan, published on January 15, examined 31,132 unique Anthropic Skills gathered from major marketplaces. The study revealed that 26.1% of Skills contained at least one vulnerability across 14 distinct patterns in four categories. Data exfiltration was present in 13.3% of Skills, while privilege escalation was found in 11.8%. Skills that bundled executable scripts were 2.12 times more likely to have vulnerabilities compared to instruction-only Skills.
Three weeks later, Snyk released ToxicSkills, a comprehensive security audit of the ClawHub and skills.sh marketplaces. The audit scanned 3,984 Skills (as of February 5) and discovered that 13.4% of all Skills had at least one critical-level security issue. Through a combination of automated scanning and human review, seventy-six confirmed malicious payloads were identified. Eight of these malicious Skills were still publicly available on ClawHub at the time of publication.
Subsequently, Cisco introduced its AI Agent Security Scanner for IDEs on April 21, integrating its open-source Skill Scanner directly into VS Code, Cursor, and Windsurf. This scanner enhances developers’ workflows by detecting security issues. However, it does not inspect bundled test files, as its focus is on the agent interaction layer rather than the developer toolchain layer.
The three major Anthropic Skill scanners share a common blind spot: they do not examine bundled test files as an execution surface, despite the fact that Gecko Security demonstrated that these files execute with full local permissions through standard test runners.
Snyk Agent Scan, Cisco’s AI Agent Security Scanner, and VirusTotal Code Insight are effective in detecting prompt injection, shell commands, and data exfiltration in Skill definitions and agent-referenced scripts. However, they do not extend their analysis beyond the agent execution surface to the developer execution surface within the same directory.
Understanding the attack chain
The details of the attack chain are crucial because the solution lies in addressing these specific steps. When a developer runs npx skills add owner/repo-name, the installer clones the Skill repository and copies its contents into .agents/skills/<skill-name>/ within the project. Agent IDEs like Claude Code and Cursor create symlinks to their respective Skill directories. Only certain files, such as .git, metadata.json, and those prefixed with _, are excluded. Everything else is stored on the disk.
Jest and Vitest both utilize dot: true in their glob engines, enabling them to discover test files inside dot-prefixed directories like .agents/. Mocha’s behavior depends on configuration but generally follows similar recursive patterns. None of these frameworks exclude .agents/, .claude/, or .cursor/ from their default discovery paths.
An attacker can create a Skill with a clean SKILL.md file and a tests/reviewer.test.ts file containing a beforeAll block. This block accesses process.env, .env files, private keys in ~/.ssh/, and credentials in ~/.aws/, sending this information to an external endpoint. The test cases appear legitimate, with the exfiltration occurring silently during setup, regardless of the test results.
This vulnerability is not limited to TypeScript; Python repositories face a similar risk through conftest.py, which pytest automatically runs during test collection. To prevent this, add .agents to the testpaths exclusion in pyproject.toml.
The .agents/skills/ directory is meant to be committed to the repository for sharing among teammates. GitHub’s default .gitignore templates do not include .agents/. Once a malicious test file enters the repository, every developer who clones and runs tests will execute the payload, as will every CI pipeline on every branch and fork that inherits the test suite.
Scanners overlook the real threat surface
CrowdStrike CTO Elia Zaitsev highlighted the operational challenge in a VentureBeat interview at RSAC 2026, stating, “Observing actual kinetic actions is a structured, solvable problem. Intent is not.”
This statement directly addresses the blind spot in Anthropic Skill scanners. Existing scanners do not operate beyond the assumption that the threat lies within the SKILL.md file and scripts instructed to run by the agent. These tools focus on analyzing intent: what actions the Skill directs the agent to take. Gecko’s discovery, however, falls on the kinetic side, where the test file executes through the developer’s own toolchain, independent of the agent. No prompts are interpreted, and the payload, written in TypeScript, runs with full local permissions through a legitimate test runner. The scanner was addressing the wrong issue.
CrowdStrike’s Zaitsev highlighted the growing presence of AI agents and non-human identities in enterprises, emphasizing that these agents will have extensive privileges and access to data sets. CrowdStrike’s Charlotte AI and similar agents already operate with these privileges, posing a security risk when credentials are easily accessible.
Mike Riemer from Ivanti pointed out the short window for threat actors to exploit vulnerabilities, emphasizing the importance of timely patching. However, many enterprises take weeks to patch, and the Anthropic Skill scanner’s blind spot exacerbates this issue by allowing malicious Skills to go undetected.
To address these security concerns, VentureBeat introduced the Anthropic Skill Audit Grid, which outlines key areas that current scanners do not cover. The grid provides recommendations for security teams to enhance their scanning processes and mitigate risks associated with Skill installation.
Additionally, VentureBeat suggests three critical steps for improving CI security, such as adding .agents/ to the test runner’s ignore list, auditing every Skill install for non-instruction files before merging, and pinning Skill sources to specific commits. These steps can be implemented quickly and do not require replacing existing tools.
Furthermore, VentureBeat provides a list of questions for security teams to ask their Anthropic Skill scanner vendors to ensure comprehensive coverage and protection against potential threats. By addressing these issues proactively, enterprises can better secure their systems and data from malicious actors.
Don’t just ask if prompt injection is detected. Dive deeper with these questions:
- Which files and directories are actually analyzed in a Skill repo?
- Are test files considered potential execution surfaces?
- Should Skills that include tests, CI configs, or build scripts be flagged as higher-risk? According to SkillScan, script-bundling Skills are 2.12 times more likely to be vulnerable.
- Do you offer guidance on restricting test-runner globs in CI pipelines? Cisco’s open-sourced Skill Scanner on GitHub provides transparency on detection categories implemented, setting a standard for all vendors. Transparency is key, as it allows security teams to verify scan coverage and potential gaps.
- Has your organization conducted an ecosystem-scale audit with detailed methodology and sample size? Snyk audited 3,984 Skills, while SkillScan audited 31,132. Riemer highlighted the importance of disclosure patterns and the need for vendors to document both detections and areas not covered to address vulnerabilities effectively.
The importance of the audit grid in addressing security gaps
The Anthropic Skills ecosystem faces similar challenges seen in early npm supply chain incidents. SkillScan’s dataset revealed vulnerabilities in a quarter of Skills, while Snyk identified 76 malicious payloads in under 4,000 Skills. The audit grid provides security teams with the necessary insights to identify and address security risks before deployment, highlighting the need for continuous monitoring and updates.
Scanner evaluations focus on known threats, but the test-file vector presents a unique challenge. It underscores the need for comprehensive scanning and patching processes to address evolving threats effectively.
The scanner may not be broken, but it is incomplete. Understanding the limitations of current scanning models is crucial in mitigating security risks effectively. Stay informed, stay vigilant, and prioritize security in every step of your Skill deployment process.
