SkillDetonate Catches Malicious AI-Agent Skills That Slip Past Scanners

Watching What a Skill Does, Not Just What It Looks Like

The best defensive ideas are often the simplest to state and the hardest to evade: judge something by its behavior, not its appearance. On July 6, 2026, researchers at the Hong Kong University of Science and Technology unveiled SkillDetonate, a runtime auditor for the add-on "skills" that AI coding agents load — and its results are a real win for defenders.

The Problem It Solves

Modern AI agents like coding assistants gain new abilities by loading "skills" — small packages of instructions and scripts that extend what the agent can do. That extensibility is powerful, but it creates a familiar software supply-chain question: how do you know a downloaded skill is safe? The researchers showed that static scanners — tools that inspect a skill's code without running it — can be fooled by obfuscation, packing, and encoding tricks that hide malicious intent behind innocent-looking text.

This is the same lesson the broader security world learned long ago about malware: if you only read the code, a determined author can disguise it. You have to watch what it actually *does*.

How SkillDetonate Works

SkillDetonate takes the behavior-centric approach. It runs a skill inside a sandbox and observes its activity at the operating-system boundary — which files it reads and writes, and, critically, where it tries to send data. Instead of trying to recognize "bad-looking" code, it tracks sensitive-data flow by destination. That design is what defeats the evasion tricks: it does not matter whether data is base64-encoded or encrypted to look harmless, because the auditor is watching the exfiltration path, not the disguise.

The numbers back up the design. In controlled tests, SkillDetonate caught 97% of attacks at just a 2% false-positive rate, and it flagged 87% of real-world malicious skills. Importantly, it stayed robust across obfuscated and packed variants — exactly the cases that slip past static analysis. A low false-positive rate matters as much as the catch rate here, because a noisy tool that cries wolf gets ignored.

Why This Is Good News

Here is what I want to emphasize: the researchers released their code. A free, open runtime auditor means skill marketplaces, agent platforms, and security teams can adopt real behavioral checks today, rather than waiting for a vendor product. That is how the defensive community closes a gap quickly and at scale.

More broadly, this is a healthy example of security research done right. Someone identified that a new capability — extensible AI agents — introduced a new attack surface, and rather than stopping at "here is a scary technique," they built and shared a practical defense with measured, honest benchmarks. The responsible framing is on the protection, and the protection works.

As AI agents become more capable and more deeply integrated into developer workflows, safeguarding the components they load is going to be foundational. Tools like SkillDetonate — behavior-first, evasion-resistant, and open — are exactly the kind of AI security infrastructure that lets us enjoy the benefits of agent extensibility with far more confidence.

Sources: The Hacker News — coverage of AI-agent skill security research — July 6, 2026; arXiv preprint 2607.02357 (Hong Kong University of Science and Technology) — July 2026.