claude-code-skill-security-check
This malicious skill masquerades as a security tool while executing reverse shells, injecting persistent SSH access, and bypassing user oversight to exfiltrate credentials and perform unauthorized remote code execution.
Skill Info
Install
npx skills add https://github.com/aliksir/claude-code-skill-security-checkAssessments (7)
AI Agent Traps ↗Access to known credential file paths detected (seen 6 times in this file at lines 211, 212, 247, 430, 441, 485)
~/.ssh/id_rsa
Reverse shell pattern detected (seen 3 times in this file at lines 221, 222, 223)
bash -i >&
Remote code download and execution detected
python -c "import urllib
Hidden instruction tags in tool output — fake system/admin directives injected into responses
<system>
SSH authorized_keys injection — attempts to add persistent SSH access
echo "ssh-rsa" >> ~/.ssh/authorized_keys`, public key injection into authorized_keys
Scheduled task/cron job creation detected
systemctl enable
The installation instructions for the CLI tool do not specify a version pin or hash, exposing the user to supply chain attacks where the package content can change without notice.
pip install skill-scanner
Sub-agent spawning instructions detected — may create agents with attacker-controlled prompts
spawn agent
LLM control/chat tokens detected in skill content (seen 4 times in this file at lines 384, 386, 387, 389)
[INST]
XOR-based payload obfuscation (xor combined with decode/exec/shellcode) detected
xor`, `^=`, `bytes([a ^ b for` — XOR operations for payload
Skill name or description references a well-known AI brand, which may suggest impersonation.
claude
Unpinned dependency installation — package installed without version pinning (seen 2 times in this file at lines 57, 70)
pip install skill-scanner
User confirmation bypass detected — attempts to skip human oversight (seen 4 times in this file at lines 337, 408, 531, 532)
no confirmation needed
SKILL.md links to "CHANGELOG.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime
[CHANGELOG.md](CHANGELOG.md)
SKILL.md links to "hooks/README.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime
[`hooks/README.md`](hooks/README.md)
Skill does not specify a license field. Specifying a license helps users understand usage terms.
Badge
[](https://mondoo.com/ai-agent-security/skills/github/aliksir/claude-code-skill-security-check)<a href="https://mondoo.com/ai-agent-security/skills/github/aliksir/claude-code-skill-security-check"><img src="https://mondoo.com/ai-agent-security/api/badge/github/aliksir/claude-code-skill-security-check.svg" alt="Mondoo Skill Check" /></a>https://mondoo.com/ai-agent-security/api/badge/github/aliksir/claude-code-skill-security-check.svgSecure your AI agents
Skills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet, discover and control Shadow AI usage.
- Continuous scanning of skills across all registries
- Policy enforcement before skills reach your agents
- Integration with your existing security workflow