hexcast.
SECURITY

Trail of Bits Bypasses Skill Scanners in Under an Hour

Trail of Bits bypassed ClawHub, Cisco, and skills.sh's skill scanners in under an hour using trivial tricks. Three malicious skills in trailofbits/overtly-malicious-skills used standard methods; a fourth took hours due to prompt injection. Scanners' static nature enables endless attack tweaks, compromising agent security.

BLOG.TRAILOFBITS.COM · JUN 3