CVE-2026-84810 in claude-skill-antivirus
Summary
by MITRE • 09/02/2026
claude-skill-antivirus fails to analyze executable files when scanning local skill directories, reading only SKILL.md while ignoring Python source, bytecode, and other artifacts in the scripts directory. Attackers can distribute skills with malicious code in non-manifest files that receive a SAFE verdict with 100/100 trust score despite containing unanalyzed executable payloads.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/02/2026
The vulnerability described involves a critical flaw in the logic of an antivirus skill, specifically within the context of local skill directories used by AI agent frameworks such as Anthropic's Claude. The core issue stems from a failure to perform comprehensive static analysis on all files present within a skill package. Instead of scanning executable artifacts like Python source code (.py), compiled bytecode (.pyc), or other script types located in the scripts directory, the system relies exclusively on reading and analyzing the SKILL.md manifest file. This architectural oversight creates a significant blind spot where malicious payloads can be embedded directly into non-manifest files while bypassing security checks entirely.
From a technical perspective, this represents an incomplete analysis of input data leading to a false negative in threat detection. When the antivirus skill processes a local directory, it extracts metadata and behavioral descriptions from SKILL.md but neglects to inspect the actual executable content that constitutes the functional part of the skill. Consequently, any Python script or binary payload hidden within these ignored files is deemed safe by default. This behavior allows attackers to distribute skills containing malicious code in non-manifest files that receive a SAFE verdict with a 100 out of 100 trust score despite containing unanalyzed executable payloads capable of arbitrary command execution or data exfiltration upon activation.
The operational impact of this vulnerability is severe, particularly in environments where AI agents are granted file system access or network capabilities based on the perceived safety of installed skills. An attacker can craft a malicious skill that appears benign when reviewed through its documentation but executes harmful operations once invoked by an agent. This could lead to unauthorized data access, lateral movement within internal networks, or compromise of host systems depending on the permissions assigned to the AI agent. The high trust score associated with these unanalyzed files further exacerbates the risk by providing a false sense of security to administrators and users who rely on this scoring mechanism for decision-making regarding skill installation and execution.
This flaw aligns closely with CWE-20, which defines Improper Input Validation, as the system fails to validate or sanitize all components of the input package before granting it trust. Additionally, it relates to CWE-1398, specifically concerning Software Composition Analysis failures where dependencies or included files are not properly scanned for vulnerabilities or malicious content. In terms of offensive security frameworks, this vulnerability facilitates techniques associated with ATT&CK T1059, Command and Scripting Interpreter, by allowing attackers to hide executable payloads within seemingly legitimate software packages that bypass automated defenses.
To mitigate this risk, developers must implement a comprehensive scanning routine that iterates through all files in the skill directory rather than relying solely on manifest-based analysis. This includes parsing Python source code for suspicious function calls, inspecting bytecode structures for obfuscation or malicious instructions, and validating any embedded scripts against known threat signatures. Security controls should be updated to enforce strict file type filtering during installation, ensuring that only verified and scanned artifacts are permitted into the execution environment. Furthermore, implementing runtime monitoring and sandboxed execution environments can provide an additional layer of defense by detecting anomalous behavior even if static analysis is bypassed. Regular audits of antivirus logic against evolving attack vectors are essential to maintain robust security postures in AI-driven application ecosystems.