Anthropic Skill scanners passed every check — but missed malicious test files — exposing developers to risk

Context

Anthropic Skill scanners have been found to pass every check, but a recent exploit demonstrates a critical blind spot: malicious test files can execute with full local permissions, exposing developers to risk. This vulnerability affects developers using Anthropic Skills from ClawHub and skills.sh, and highlights the need for security teams to verify the detection surfaces of their scanning tools. As the Anthropic Skills ecosystem continues to grow, this gap in scanner coverage poses a significant threat to enterprise security.