The sorry state of skill distribution
blog.trailofbits.com | blog | #ai-security | #supply-chain | #agentic-ai | #malware | #prompt-injection | #static-analysis | #skill-marketplace | #agent-security | #clawhub | #scanner-bypass
Summary
Trail of Bits bypassed ClawHub's malicious-skill detector, Cisco's skill scanner, and all three skills.sh scanners in under an hour, showing static scanning cannot secure agentic skill supply chains.
- Published
- Collected
--- id: 1268 title: "The sorry state of skill distribution" source_domain: blog.trailofbits.com source_url: "https://blog.trailofbits.com/2026/06/03/the-sorry-state-of-skill-distribution/" published_at: "2026-06-03 11:00" tags: ["ai-security", "supply-chain", "agentic-ai", "malware", "prompt-injection", "static-analysis", "skill-marketplace", "agent-security", "clawhub", "scanner-bypass"] phying_url: "https://phying.com/item/1268" lang: en --- # The sorry state of skill distribution ## Summary Trail of Bits bypassed ClawHub's malicious-skill detector, Cisco's skill scanner, and all three skills.sh scanners in under an hour, showing static scanning cannot secure agentic skill supply chains. ## Intelligence Metadata - **Sources:** blog.trailofbits.com - **Published:** 2026-06-03 11:00 - **Original:** https://blog.trailofbits.com/2026/06/03/the-sorry-state-of-skill-distribution/ - **Phying News:** https://phying.com/item/1268