Skill scanning
Coding assistant security
A skill file is plain Markdown your assistant reads and obeys, which makes it an instruction channel with no review step in front of it. Beam scans one before you run it, reading the file as inert text.
The report names what matched and where. It is triage, not proof of safety.
What the skill scanner checks
Coding assistants are the AI surface with the deepest access to real systems, so they get their own pre-run check — eleven heuristic categories, each quoting the text that matched.
- Credentials
References and delivery
Reads of API keys, tokens, .env files and SSH material — and, separately, instructions that route them somewhere.
- Execution
Downloaded and encoded payloads
Fetch-then-run chains and obfuscated commands: the two shapes used to keep the real instruction out of the readable file.
- Destruction
Deletion instructions
Recursive removal and data-destroying commands, the class behind the most widely reported agent incidents.
- Persistence
Writes to startup targets
Shell profiles, launch agents, cron and hook configuration — anywhere a skill can arrange to run again.
- Escalation
Privilege and metadata access
Permission changes, cloud instance-metadata endpoints, network sweeps and reverse-shell constructions.
- Override
Instructions aimed at the model
Text telling the assistant to ignore prior guidance, hide its actions, or treat the skill's rules as outranking yours.
Scanner facts
- Original content
- Not retained after the report is written
- Automatic pulls
- None — Beam does not fetch or install skills
- Clean report
- Triage only — not a clearance
Reviewing a skill in three moves
- 01
Scan it before it is installed
Point the scanner at the file you are about to add. Nothing runs, and Beam does not fetch it — you bring the file.
- 02
Read the matched text
"You MUST call this function first" is not malicious; "attach this key to an outbound URL" is. Findings quote what triggered them.
- 03
Watch it at runtime anyway
A clean scan is not a clearance. Once the skill runs, its commands and tool calls land in the same local log.
The skill layer is an active attack surface
2025–2026
Malicious skills on public marketplaces
The OpenClaw/ClawHub wave and the ToxicSkills research line showed the same thing: marketplaces distribute instruction files with no meaningful review.
2026
Cato CTRL weaponized a Claude Skill to run ransomware
Researchers drove MedusaLocker execution from a skill file — proof that the skill layer is a delivery channel, not a curiosity.
2025–2026
CVE-2025-59536 and CVE-2026-21852 in Claude Code
Check Point disclosed hook and configuration injection plus credential exfiltration via ANTHROPIC_BASE_URL. Config files are part of the attack surface.
Honest boundaries
Beam does
- Scan skill files and AI instruction documents against 11 abuse heuristics
- Quote the matched text so you can rule out false positives
- Persist reports locally while discarding the original content
- Feed the same local log as runtime monitoring
Beam does not
- Fetch, install or intercept skills from a marketplace
- Prove a skill is safe, or perform semantic malware analysis
- Automatically intercept a marketplace install — scanning is explicit; runtime policy can still deny matching tool calls on Claude Code and Codex
- Replace reading the file before you hand it real credentials
Questions about skill scanning
What is an agent skill security risk?
A skill is a Markdown instruction file an assistant loads and follows. Because its contents are treated as instructions rather than data, a skill can direct the assistant to read credentials, post them to an external host, or ignore your own rules — with no software vulnerability involved.
Does scanning a SKILL.md execute anything in it?
No. The file is read as inert text and matched against heuristic patterns. Beam's own test fixtures include commands that look destructive precisely to prove they are never executed.
Is a clean scan a guarantee the skill is safe?
No. Eleven heuristic patterns catch documented abuse shapes; they are not semantic malware analysis. Treat a clean report as one input into your own review, especially for a skill you are about to give real credentials.
Which AI tools does this cover?
The scanner works on the file, not the vendor, so any Markdown-based skill or instruction document can be scanned — assistant skills, agent rule files and MCP configurations. Runtime coverage is likewise source-agnostic.
Related
- MCP security scanningThe same heuristics for MCP configs, plus a version-pin check.
- Runtime monitoringWhat the skill actually did after you approved it.
- Coding assistant security guideHow the instruction layer is attacked, and what a review should look for.
- The universal jailbreak claimSpoofed tool calls and CTF framing: what is verified and what to lock down.
Review the skill before your assistants do
Scanning a file costs a minute and runs entirely on the endpoint. An unreviewed instruction file reaching a developer fleet costs whatever it was written to take.