CVE-2026-84810: claude-skill-antivirus Analysis Bypass via Manifest-Only Local Directory Scan
claude-skill-antivirus fails to analyze executable files when scanning local skill directories, reading only SKILL.md while ignoring Python source, bytecode, and other artifacts in the scripts directory. Attackers can distribute skills with malicious code in non-manifest files that receive a SAFE verdict with 100/100 trust score despite containing unanalyzed executable payloads.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this bypass?
Users or systems that scan local claude-skill-antivirus skill directories are exposed when they rely on the scanner's verdict or trust score to assess a skill. Skills containing executable content outside SKILL.md, including files in a scripts directory, may be marked SAFE without that content being analyzed.
What does an attacker need to exploit this issue?
An attacker needs to distribute a skill whose manifest appears benign while placing malicious executable payloads in non-manifest files such as Python source or bytecode. Exploitation also requires a user to interact with the skill, as indicated by the required user interaction metric.
Are default scan results sufficient to detect malicious code in skill directories?
No. The affected local-directory scan behavior reads only SKILL.md and ignores Python source, bytecode, and other artifacts in the scripts directory, so a SAFE verdict and 100/100 trust score do not establish that all skill code was analyzed.
What can be done before a fix is available?
Do not rely solely on claude-skill-antivirus results for local skill directories. Manually inspect executable and non-manifest files, particularly content under scripts directories, before trusting or using a skill.