SkillCamo: hidden image instructions slip past agent-skill scanners

What is this?

Agent skills are the npm packages of the agent era: small bundles of plain-English instructions, scripts, and files that a coding agent such as Claude Code or OpenAI Codex loads on demand to gain a new capability. One marketplace filled with more than 40,000 community-contributed skills within months of the format appearing in late 2025, and most were never vetted. That combination — implicit trust plus the agent’s full privileges — has already produced real supply-chain incidents, including the ClawHavoc campaign that planted 341 malicious skills on a single hub.

A paper published in June 2026, “Seeing Is Not Screening: Multimodal Hidden Instruction Attacks on Agent Skill Scanners” (arXiv 2606.18198), documents a blind spot in the defenses built to catch these skills. Today’s skill scanners read the text: descriptions, manifests, and source code. The paper’s attack, SkillCamo, hides the malicious instruction where the scanner does not look — inside an image bundled with the skill.

How it works

SkillCamo splits a malicious skill across two modalities so that neither half looks dangerous on its own.

The attack takes a target command from a malicious script and renders it as an image resource — one that looks like an ordinary project logo, workflow chart, screenshot, or usage example. It then uses an LLM to rewrite the skill’s entire documentation so that the injected image is framed naturally as part of the setup instructions or workflow illustration. A reviewer skimming the README sees a helpful diagram; a text-and-code scanner sees clean files.

The payload only becomes legible when a multimodal agent does what the rewritten docs tell it to: read the image as part of the normal workflow. At that point the model interprets the visual content as actionable instruction and steers toward unsafe execution. As the authors put it, the malicious intent is distributed across modalities and is fully revealed only when the agent jointly interprets documentation, code context, and visual content at run time.

No payloads are reproduced here. The mechanism is a variant of a broader problem: instructions can be smuggled into a skill in forms that survive human review. Independent work by Embrace The Red in February 2026 showed the same failure in the text channel, using invisible Unicode-tag codepoints that models will follow but a human reading the file cannot see. Images are simply the next channel scanners forgot to check.

Why it matters

Skill scanners return a block-or-allow verdict at install time, and deployers increasingly rely on that verdict. SkillCamo shows the verdict is only as good as the modalities the scanner inspects. If a scanner reasons over text and code but treats bundled images as inert assets, a malicious skill can pass review and then execute credential theft, source-code exfiltration, or a dropped backdoor once it runs with the agent’s privileges.

This is not an isolated finding. Parallel research disclosed the same week — covered by Help Net Security on July 9, 2026 — showed that byte-level static scanners can be evaded more than 90% of the time by attackers who keep a skill’s behavior intact and change only its surface form. The pattern rhymes with decades of malware defense: inspection of the wrapper loses to attackers who repackage the same behavior, and the durable answer has always been to watch what code actually does.

Defenses

Static, single-modality scanning is necessary but not sufficient. Concretely:

1. Scan every modality, not just text and code. Run OCR and vision analysis over bundled images, and treat any image a skill instructs the agent to “read” as a potential instruction channel, not a decorative asset.

2. Move to execution-grounded analysis. The paper’s defense, ExecScan, infers a skill’s declared purpose and access scope from its docs and metadata, reconstructs the skill’s actual executable behavior by mapping referenced scripts, files, environment access, and visual resources, and then judges whether it exhibits exfiltration, destruction, persistence, deception, or privilege-escalation capabilities. It also simulates how a multimodal agent would interpret the skill in realistic use — including the influence of image-carried instructions on downstream planning. Parallel behavioral-sandbox work reports catching around 97% of injected payloads by watching system calls at the OS boundary, where a static scanner sees nothing.

3. Sandbox the agent and scope its privileges. Grant file, credential, network, and package-manager access explicitly rather than by default, so a skill that slips through cannot reach secrets or exfiltrate. Avoid blanket auto-approval of Bash and tool calls.

4. Treat skills as untrusted supply-chain dependencies. Install only from trusted vendors, prefer the minimum set, and uninstall skills you no longer use. Human review is a control, but invisible-Unicode and image-borne payloads are both designed to survive it.

5. Prefer least privilege at the capability layer. A skill that never needed outbound network or credential access should not have it; capability scoping limits blast radius regardless of what a scanner missed.

Status

Item	Reference	Date	Notes
SkillCamo attack + ExecScan defense	arXiv 2606.18198	2026-06	Image-hidden instructions bypass text/code scanners; execution-grounded scanning proposed
Static-scanner evasion (parallel work)	Help Net Security	2026-07-09	Byte-level scanners evaded >90%; behavioral sandbox catches ~97%
Invisible-Unicode instructions in skills	Embrace The Red	2026-02-11	Hidden text-channel instructions survive human review
ClawHavoc marketplace campaign	Koi Security	2026	341 malicious skills planted on a single hub

The takeaway is not “don’t use skills.” It is that install-time scanning that reads only text and code is a partial control. As agents gain multimodal comprehension, every modality a skill can carry becomes an instruction channel — and defenses have to reconstruct what a skill does, across all of them, rather than inspect what it looks like.