---
id: 1268
title: "The sorry state of skill distribution"
source_domain: blog.trailofbits.com
source_url: "https://blog.trailofbits.com/2026/06/03/the-sorry-state-of-skill-distribution/"
published_at: "2026-06-03 11:00"
tags: ["ai-security", "supply-chain", "agentic-ai", "malware", "prompt-injection", "static-analysis", "skill-marketplace", "agent-security", "clawhub", "scanner-bypass"]
phying_url: "https://phying.com/item/1268"
lang: en
---

# The sorry state of skill distribution

## Summary

Trail of Bits bypassed ClawHub's malicious-skill detector, Cisco's skill scanner, and all three skills.sh scanners in under an hour, showing static scanning cannot secure agentic skill supply chains.

## Intelligence Metadata

- **Sources:** blog.trailofbits.com
- **Published:** 2026-06-03 11:00
- **Original:** https://blog.trailofbits.com/2026/06/03/the-sorry-state-of-skill-distribution/
- **Phying News:** https://phying.com/item/1268