Research · curated 31 Jul 2026
A hole in every one: bypassing the open source AI skill scanners
First reported adversa.ai
Coverage timeline
Single-source research — first reported, latest, and curated coincide.
Why it matters
Agent-skill scanners convert an untrusted stranger's SKILL.md into a green check that developers trust enough to install with their own credentials, so demonstrable bypasses across every tested scanner mean the marketplace defenses defenders rely on offer little real protection.
Adversa's Omer Ben Simon tested eight open source AI agent-skill scanners (including Cisco, NVIDIA, mondoo, skillcop, claude-av, huifer, ai-skill and the OASB leaderboard leader HMA) against real attacks and got a malicious skill past all eight. The shared flaw is a missing front end: scanners match the literal bytes in a SKILL.md file rather than decoding, normalizing Unicode, or re-scanning executed payloads, so encoding, homoglyphs, paraphrasing, reassembly and even framed injections into an LLM judge prompt bypass detection.