SkillTrace

🛡️ SkillTrace


[](https://pypi.org/project/skilltrace/) [](https://pypi.org/project/skilltrace/) [](https://github.com/handcraftedbygod/SkillTrace/actions/workflows/ci.yml) [](LICENSE)  

**A defensive, behavioral scanner for agent skills — Claude, Cursor, and Codex — built to close the detection gap SkillCloak identified in static-only tools.**

A July 2026 academic paper ([arXiv:2607.02357](https://arxiv.org/abs/2607.02357), HKUST) disclosed **SkillCloak**: malicious Claude/Codex skills that hide payloads (self-extracting blobs, obfuscated instructions in `.git/`-style paths) and evade static scanners more than 90% of the time. It made Hacker News and thehackernews.com. Every "skill security" tool available at the time was static-analysis-only, which is exactly what the paper shows is bypassable.

Traditional malware scanners inspect code. An agent skill can carry out its entire attack as natural-language instructions that an agent reads and follows with its own already-granted tool access, no executable payload required at all. That changes the detection problem from binary inspection to behavioral verification. SkillTrace runs a candidate skill inside a disposable, network-sandboxed container and reports what it *actually* does: network destinations (including decrypted HTTPS host/path/body), subprocess spawns, and out-of-scope file access, instead of just trusting its