Key points
- JFrog research shows evasion techniques bypassed eight scanners over 90% of the time.
- AI assets like SKILL.md files contain instructions that traditional SCA and SAST tools cannot analyze.
- No CVE exists because the threats are embedded as valid Markdown instructions rather than code vulnerabilities.
Standard application security tools often fail to detect malicious content within AI coding agent assets. First-hand research published by JFrog indicates that agent skills, plugins, and Agent Package Manager manifests can slip past conventional scanners. These assets carry instructions and intent rather than just compiled code, creating a significant blind spot for organizations relying on traditional static analysis methods.
In plain English
Traditional security scanners check for known vulnerabilities in third-party components or analyze source code paths. They do not understand the instructions embedded in AI agent assets. A SKILL.md file tells an agent how to perform tasks, but it does not have a dependency tree for Software Composition Analysis to resolve. Consequently, malicious intent hidden within these text files remains invisible to tools designed to find code flaws or exposed credentials.
The background
In July 2026, researchers built an evasion framework to test this gap. They rewrote malicious skills to hide payloads until execution. The team tested these against 1,613 real malicious skills found in the wild using eight different scanners. Their strongest technique evaded each scanner more than 90% of the time. The cloaked skills still functioned correctly inside production agents like Claude Code and Codex, allowing for credential theft and backdoor installation despite passing static scans.
What changes now
The research highlights four threat classes in AI assets: prompt injection, hidden instructions, obfuscated payloads, and credential exfiltration. There is no Common Vulnerabilities and Exposures identifier for these issues because the instructions are classified as valid Markdown. The agent reading the file already holds the necessary credentials. Developers rarely read every line of a skill before installation, making manual review an unreliable defense against these sophisticated, hidden threats.
Who needs to act first
Teams should prioritize reviewing systems that use AI coding agents with external skill installations. Check whether your current security tools can analyze Markdown instructions and agent intents, not just code. If your scanners cannot inspect these assets, assume they are blind to this risk. Roll out changes carefully by testing new skills in isolated environments before allowing team-wide adoption. Ensure that agents operate with minimal necessary permissions to limit damage if a malicious instruction executes.
What to do and how to stay safe: JFrog
- Verify if your application security scanners support analysis of AI agent instructions and Markdown files.
- Restrict AI coding agents from accessing sensitive credentials or production systems unless explicitly required.
- Require manual review of all third-party skills and plugins before they are added to development workflows.
- Monitor agent logs for unusual file access or data exfiltration attempts during skill execution.
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Why don't standard scanners catch these threats?
Traditional tools analyze code paths and dependencies, but AI assets contain instructions and intent that these scanners are not designed to interpret.
Is there a CVE for this vulnerability?
No, there is no CVE because the threats are embedded as valid Markdown instructions rather than software code vulnerabilities.
Which agents were tested in the research?
The researchers tested the evasion techniques against production agents including Claude Code and Codex, finding they executed the malicious skills successfully.
