CVE-2026-84810 Overview
CVE-2026-84810 affects claude-skill-antivirus, a security scanner intended to analyze Claude skill packages before execution. The scanner reads only the SKILL.md manifest when analyzing local skill directories. It ignores Python source, bytecode, and other executable artifacts stored in the scripts directory. As a result, attackers can distribute skills that contain malicious payloads in non-manifest files and still receive a SAFE verdict with a 100/100 trust score. The flaw is categorized under CWE-693: Protection Mechanism Failure and is tracked in the VulnCheck advisory.
Critical Impact
Malicious skills bypass antivirus analysis entirely and are marked as trusted, allowing arbitrary code to run under the user's identity when the skill is invoked by Claude.
Affected Products
- claude-skill-antivirus v2.1.3 (see scanner source)
- Claude skill environments that rely on claude-skill-antivirus for pre-execution validation
- Local skill directories containing a scripts subdirectory with Python or bytecode artifacts
Discovery Timeline
- 2026-09-02 - CVE-2026-84810 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-84810
Vulnerability Analysis
The scanner's local directory workflow treats the SKILL.md manifest as the only source of truth for skill contents. When invoked against a local path, the tool parses the manifest, extracts declared instructions, and submits that text for analysis. Files that sit alongside the manifest, including Python modules under scripts/, compiled .pyc bytecode, and other executable artifacts, are never opened or hashed. Because Claude executes those artifacts at runtime, the analysis surface and the execution surface diverge. Attackers only need to keep SKILL.md benign while placing hostile logic in a sibling file.
Root Cause
The root cause is a protection mechanism failure in the local-scan code path. The remote download path in src/utils/downloader.js retrieves the full package, but the local scanner in src/scanner/index.js short-circuits to a manifest-only read. No file enumeration or recursive walk is performed against the skill directory. Community discussion in GitHub issue #33 confirms the divergence between local and remote scan behavior.
Attack Vector
An attacker publishes or delivers a skill directory containing a clean SKILL.md and a malicious scripts/*.py or scripts/*.pyc file. The victim runs claude-skill-antivirus against the local path and receives a 100/100 SAFE verdict. When Claude later loads the skill, the scripts execute with the user's privileges. Exploitation requires user interaction to install and invoke the skill, and no authentication is needed. A proof-of-concept is published in the skills-scanner-bypass repository.
No verified code examples are available. Refer to the VulnCheck advisory for the technical write-up.
Detection Methods for CVE-2026-84810
Indicators of Compromise
- Skill directories where SKILL.md declares no scripting behavior but a scripts/ subdirectory contains .py, .pyc, or other executable files.
- Scanner output reporting a SAFE verdict with a 100/100 trust score for skills that include non-manifest executable artifacts.
- Unexpected Python interpreter processes spawned as children of the Claude client after a skill is invoked.
Detection Strategies
- Compare the file list under each skill directory against the files referenced by the scanner's audit log. Any file present on disk but absent from the scan trail indicates unanalyzed content.
- Hash every artifact under scripts/ and cross-check hashes against known-good skill releases before allowing execution.
- Run a second-opinion static analysis pass (for example, YARA or a Python AST linter) over the full skill directory rather than the manifest alone.
Monitoring Recommendations
- Log process creation events for Python and shell interpreters launched by the Claude client, and alert on outbound network connections that follow skill activation.
- Monitor file system writes to user skill directories and flag additions of executable artifacts outside SKILL.md.
- Track version strings of claude-skill-antivirus deployed across endpoints so that vulnerable v2.1.3 installs can be inventoried.
How to Mitigate CVE-2026-84810
Immediate Actions Required
- Stop relying on claude-skill-antivirus v2.1.3 local-directory scans as the sole gate for skill trust decisions.
- Manually inspect the full contents of any skill directory, including every file under scripts/, before execution.
- Restrict skill installation to a curated allowlist maintained by the security team.
Patch Information
No fixed release is referenced in the NVD entry at the time of publication. Track the upstream claude-skill-antivirus repository and issue #33 for a patched version that enumerates and analyzes all files in a skill directory.
Workarounds
- Force the scanner through its remote download path against a packaged archive rather than a local directory, so that all files are retrieved and inspected.
- Wrap the scanner with a pre-check script that enumerates every file in the target directory and rejects skills whose file set is not fully covered by the scan report.
- Execute skills inside a sandboxed user account or container with no access to sensitive data, network egress controls, and no persistent write privileges.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
