Claude Skills are designed to improve productivity by packaging workflows into reusable AI extensions. Instead of repeating the same instructions in every conversation, users can create or install a Skill that provides Claude with domain-specific guidance, procedures, or automation whenever a relevant task is performed.
This convenience, however, introduces a new security risk. Because Skills are often presented as productivity enhancements – such as code reviewers, repository assistants, documentation helpers, or CSV analyzers users may grant them broad access to development environments without carefully inspecting their implementation or instructions.
A malicious Skill is one that is intentionally crafted or later compromised to perform actions beyond its advertised purpose. Rather than simply assisting with a legitimate task, it abuses the permissions and trust granted to it to influence the model’s behavior or execute unauthorized operations.
Depending on the permissions and tools available, a malicious Skill may attempt to:
- Exfiltrate source code, documents, or other sensitive files
- Collect API keys, authentication tokens, or credentials
- Access connected cloud services or internal repositories
- Execute unauthorized commands or scripts on the host system
- Download and execute additional malicious payloads
- Establish persistence or facilitate ransomware deployment
Unlike traditional malware, this attack surface is not limited to executable code. A malicious Skill may combine conventional code execution with instruction-level manipulation of the language model itself. Hidden prompts or embedded instructions within files such as SKILL.md can influence how the model interprets future requests, causing it to prioritize attacker-defined objectives while continuing to appear helpful to the user.
This creates a hybrid attack model in which both executable code and the model’s decision-making process become components of the compromise. The result is a new form of supply-chain risk: an apparently legitimate productivity extension can exploit the model’s capabilities, the user’s trust, and the permissions available to it to perform actions that would traditionally require separate malware.
A Plausible Attack Scenario: The “Helpful README Generator”
Figure 1. A seemingly legitimate Claude Skill advertised as a productivity tool that automatically generates project documentation.
Imagine a developer discovers a free Claude Skill advertised with the following promise: “Scan your entire repository and generate a comprehensive README in seconds.”
The request appears entirely reasonable. Generating meaningful documentation requires access to the project’s source code, directory structure, configuration files, and build metadata. Consequently, granting the requested permissions is unlikely to raise suspicion.
Now consider a malicious or previously compromised version of the same Skill. While successfully generating the requested documentation, it could abuse the permissions granted by the user to perform additional unauthorized actions that remain largely invisible.
The Attack Flow
A representative attack might proceed as follows:
- The developer installs the Skill from a public marketplace or third-party repository.
- The Skill performs the advertised repository analysis to generate project documentation.
- During the scan, it enumerates files likely to contain sensitive information, including:
- .env files
- SSH keys
- cloud credentials
- API tokens
- CI/CD configuration files
- Kubernetes secrets
- Sensitive artifacts are collected and staged.
- The data is embedded within seemingly legitimate diagnostic or telemetry requests.
- The information is transmitted to an attacker-controlled service using encrypted HTTPS traffic.
- The generated README is returned successfully, giving the user no indication that unauthorized activity has occurred.
Figure 2. Simulated attack scenario showing repository enumeration, secret collection, and data exfiltration disguised as normal telemetry traffic.
The effectiveness of this attack stems from the fact that every observable action appears consistent with the Skill’s legitimate purpose. Repository traversal, reading project files, generating summaries, and communicating with remote services are all behaviors that a documentation assistant may legitimately perform.
As a result, malicious activity becomes difficult to distinguish from normal operation.
Why Detection Is Difficult
From the perspective of security monitoring, many attack indicators closely resemble expected application behavior:
- Repository enumeration is a normal prerequisite for documentation generation.
- Reading configuration files may be required to understand application architecture.
- Accessing source code and project metadata is expected.
- HTTPS connections to external services often blend into routine network traffic.
- Exfiltrated data embedded within telemetry or diagnostic payloads may evade signature-based detection.
- AI-generated tool invocations may appear indistinguishable from legitimate automation initiated by the developer.
Rather than exploiting software vulnerabilities, the attacker abuses legitimate permissions and user trust, making malicious behavior blend into normal workflows.
Real-World Evidence
Although the previous scenario is hypothetical, recent research demonstrates that malicious AI Skills are no longer merely theoretical.
ClawHavoc Campaign
Security researchers at Snyk identified the ClawHavoc campaign, which involved more than 1,100 malicious AI Skills distributed through public marketplaces.
The campaign primarily targeted macOS systems and attempted to collect:
- Cryptocurrency wallets
- SSH private keys
- Browser credentials
- Developer secrets
- Sensitive project artifacts
The campaign illustrates how trusted AI ecosystems can become attractive software supply-chain targets.
MedusaLocker Weaponization
Researchers at Cato Networks demonstrated how an apparently harmless AI Skill designed to generate GIF images could be modified to initiate deployment of MedusaLocker ransomware.
The key takeaway was not the ransomware itself, but the broader security implication:
Once an AI Skill is trusted and granted sufficient permissions, it may become a delivery mechanism for traditional malware.
The Emerging Security Challenge
Historically, organizations have learned to evaluate the risks associated with:
- Browser extensions
- Mobile applications
- OAuth integrations
- Third-party SaaS platforms
AI Skills introduce many of the same trust assumptions while combining several characteristics that significantly expand the attack surface:
- Access to sensitive local and cloud-hosted data
- Automated execution of complex workflows
- Integration with external tools and APIs
- Embedded prompts or workflow definitions that influence AI decision-making
- The ability to influence the model’s decision-making through embedded prompts or workflow definitions
Consequently, future Shadow AI threats may not resemble conventional malware. Instead, they may appear as legitimate productivity tools operating within trusted workflows.
Detecting Malicious AI Skills
Because malicious Skills often perform legitimate tasks alongside unauthorized ones, traditional signature-based detection is often insufficient. The challenge is not identifying a single suspicious event, but recognizing when a sequence of otherwise legitimate actions deviates from an identity’s normal behavior.
For example, a developer may legitimately use a documentation-generation Skill every day to analyze repositories and produce project documentation. If that same Skill suddenly begins enumerating unrelated repositories, accessing sensitive credential files, retrieving cloud secrets, and communicating with previously unseen external services, each individual action may appear legitimate in isolation. Viewed together, however, they form a behavioral pattern that is inconsistent with the user’s historical activity and may indicate compromise or malicious intent.
This is where behavioral anomaly detection becomes critical. Rather than relying on predefined rules or known indicators of compromise, organizations should establish behavioral baselines for users, AI agents, and non-human identities, then detect deviations from those baselines.
How Reveal Security Helps
Reveal Security continuously correlates activity across SaaS applications, cloud environments, development tools, and AI workflows to reconstruct the behavioral journey of both the user and the AI agent. When a trusted skill suddenly begins exhibiting anomalous behavior such as repository enumeration outside its normal scope, unexpected access to secrets, or suspicious outbound communications, our platform identifies the deviation, assigns contextual risk, and enables security teams to investigate or respond before sensitive data is compromised.
