Sunday 26 July 2026 13:10:46 GMT+02:00
Netcrook
#static scanners
When an AI Skill Hides Its Teeth, Static Scanners See Only a Toy
Security researchers have shown that malicious add-on skills for AI coding agents can be packed to look harmless at install time, exposing a trust gap in today’s plugin-style defenses.
When AI Skills Become the Payload: Static Scanners Lose Sight of the Trap
A new supply-chain risk in LLM coding agents shows why install-time checks can miss malicious skill packages that only reveal their behavior once execution begins.