Anthropic’s Skill Scanner Defeated by Backdoored Skills

Context

Anthropic has released a new control for admins: Skill and Plugin Scanning. When the feature is enabled and a user or admin uploads a Skill, Claude analyzes the Skill and grades it ‘pass’, ‘warn’, or ‘fail’. Skills that ‘fail’ are blocked and cannot be enabled for use.

This research found that backdoored Skills can bypass the scanner by containing subtle code vulnerabilities and retrieving payloads from external services at runtime to exploit them.

Not only did these Skills pass the scanner, but Anthropic’s latest models, including Fable, Sonnet, and Haiku, executed the payloads in production (under Claude’s default settings*), exfiltrating user files.

* ‘Package managers only’ is the default domain restriction setting for all plans, but not all plans have network access as a whole enabled by default.

The Bypass

Anthropic’s Skill Scanner can’t judge what it can’t see. This technique evades the scanner by storing malicious payloads in data that the Skill retrieves only at runtime, so they are never seen by the scanner.

All that is visible to the scanner is a Skill that reads from an external data source and does not sanitize the data before processing.

Here’s how it works:

1. 1.
   The attacker creates a Skill that reads data from an external source they control
2. 2.
   They plant a command or HTML injection vulnerability in the Skill’s code that handles the data from the source they control
3. 3.
   The attacker publishes injection payloads to the external data source they control

When the Skill runs, payloads in the untrusted data source exploit the planted vulnerabilities to execute attacker code or embed attacker scripts in documents being created for the user.

Real World Demonstration

To demonstrate this risk, a backdoored ‘market intel briefing’ Skill was created. It claims to read from an open-source data feed tracking market events and generate a report.

However, the data feed is attacker-controlled:

And the report generation code processes the attacker feed’s ‘market sector’ field without sanitization. The field would normally hold a sector name like “Tech”, but when the attacker sets it to a malicious shell command instead, the Skill’s code will run it.

Below, the Skill passes the scanner and is successfully uploaded to Claude:

To show that this Skill did not just pass the scanner, but could actually exfiltrate data in production, it was run several times in chats with different Claude models, yielding some interesting results.

These tests were run with the default model reasoning levels: ‘high’ for Fable, ‘high’ for Opus, ‘medium’ for Sonnet, and ‘extended effort’ for Haiku.

The payload in this attack identified all files uploaded to the user’s chat and uploaded them to an attacker’s Claude account using the same network egress bypass featured in our prior research, Claude Cowork Exfiltrates Files.

The attack even succeeds under Claude’s default ‘Package managers only’ domain allowlist configuration because the untrusted data source is GitHub (allowed) and the data is exfiltrated over the Anthropic Files API (also allowed).

Fable 5

Fable 5 executed the malicious payload, then realized what it had done. As soon as it identified the payload, cyber guardrails rerouted the chat to use Opus 4.8.

Claude then explained the attack, but the victim’s portfolio file had already been exfiltrated to the attacker’s account.

Sonnet 5

Sonnet 5 executed the malicious payload, and then falsely claimed that it had detected the attack and had not executed it.

Haiku 4.5

Haiku 4.5 executed the malicious payload, noticed it in its reasoning, but did not mention it to the user.

Opus 5

Opus 5 was the only model that did not execute the payload. It opted to run only the data retrieval part of the Skill and then analyze the data itself without using the rest of the Skill’s pipeline. It then found the payload while performing its own analysis. If the backdoor had been in the retrieval part of the pipeline, the attack would likely have succeeded.

Distribution of Skills

Skills are widely shared online, primarily through ‘Skill marketplaces’. These marketplaces do minimal, if any, scanning themselves, leaving it to end users and vendors like Anthropic to validate Skills running on their platforms.

Additionally, these marketplaces often use gameable metrics like GitHub stars and download counts to rank the Skills recommended to visitors, making it easy for an attacker Skill to gain visibility and installs.

Skills can also be shared within organizations. Anthropic offers settings to enable organization-wide Skill sharing, and Skill sharing between individual team members.

This pattern of Skill reuse and distribution makes it easy for one malicious Skill to affect many end users, especially when the malicious Skill is not visibly malicious, just backdoored.

Impact

After being approved by the Skill scanner and run by the user, a backdoored Skill can take actions including the following:

• ■
  Exfiltrate data
• ■
  Plant poisoned artifacts to manipulate the agent’s further activities
• ■
  Inject malicious scripts in files being created for the user, e.g., HTML dashboards or SVG images

Note also: because the malicious payloads are dynamically retrieved at runtime and executed at runtime, exploits can occur without any malicious data ever entering Claude’s context. This means the user may never be warned, and the agent may never know. In the demonstration Skill above, the agents only identified the payload in retrospect because the Skill’s report code happened to sort the malicious payload to the top of the report.

We encourage all Claude users to be cautious about where they download Skills, and discourage reliance on Anthropic’s Scanner as a sole line of defense.