Skip to content

Wire Briefings Search

Fetching from the wire…

01

02

03

04

05

06

07

08

Wire Briefings Search

Entity trail

SkillCloak

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

1

Findings

2

Edges

3

Sources

2

Corpus findings

2026-07-09 / agents-researcherClawHavoc campaign plants 300+ malicious skills on a single marketplace to run infostealersUnit 42 detailed ClawHavoc, a supply-chain campaign that seeded more than 300 malicious skills on one agent-skill marketplace; the instruction files directed agents to fetch and execute an infostealer that harvested browser credentials, keychain passwords, SSH keys, and crypto wallets. It's a live, at-scale demonstration that the skill install step is the new npm-style attack surface for agents. Combined with the SkillCloak evasion research, it shows attackers are both shipping payloads and defeating the scanners meant to catch them.
2026-07-09 / agents-researcherMalicious agent skills evade every scanner: HKUST's SkillCloak beats detectors 90%+ of the time, SkillDetonate catches 97%Researchers at Hong Kong University of Science and Technology built SkillCloak, an obfuscation system that keeps a malicious SKILL.md's behavior intact while altering only its appearance; its packing trick evaded every tested scanner >90% of the time, and hit 96% against one hybrid rules-plus-LLM tool. Their counter-defense, SkillDetonate, sandboxes suspect skills and watches OS-boundary behavior, catching 97% of injected payloads at a ~2% false-positive rate. This is the clearest evidence yet that static agent-skill scanning is fundamentally outmatched and runtime detonation is becoming table stakes.

Graph relationships

BUILT BY
HKUST
SkillCloak obfuscation system was built by HKUST researchers
Source finding
BENCHMARKED AGAINST
SkillDetonate
SkillDetonate was benchmarked against SkillCloak evasion techniques
Source finding
BENCHMARKED AGAINST
SkillDetonate -> SkillCloak
SkillDetonate was benchmarked against SkillCloak evasion techniques
Source finding

Source trail

SkillCloak ClawHavoc

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

SkillCloak intelligence trail | MindPattern