Key points
- Standard SCA and SAST tools fail to detect malicious intent in AI agent skills and plugins.
- A July 2026 study found evasion techniques bypassed eight scanners more than 90% of the time.
- No CVE exists for these Markdown-based instruction attacks, complicating automated detection.
JFrog research highlights a significant gap in application security scanning regarding AI assets. Standard tools designed for code and dependencies often miss malicious instructions embedded in agent skills, plugins, and package manifests.
What happened
JFrog published first-hand research titled "Scanning AI Assets: Catching What SCA and SAST Might Miss" in July 2026. The study demonstrates that conventional security scanners struggle to identify threats within AI coding agent assets. These assets include SKILL.md files, agent plugins, and Agent Package Manager (APM) manifests.
Unlike traditional software, these files contain instructions and intent rather than just compiled code. This structural difference means Static Application Security Testing (SAST) has no code path to trace, and Software Composition Analysis (SCA) has no dependency tree to resolve. Consequently, these assets slip through existing security pipelines undetected.
Why it matters
Researchers built an evasion framework to rewrite malicious skills, hiding payloads until the agent executed them. They tested this against 1,613 real malicious skills found in the wild using eight different scanners. The strongest evasion technique bypassed each scanner more than 90% of the time. Despite being flagged as safe by static analysis, these cloaked skills functioned correctly inside production agents like Claude Code and Codex. The attacks caused credential theft, source code exfiltration, and backdoor installation without reducing task success rates. There is no CVE for these flaws because the instructions are classified as valid Markdown.
What happens next
Security teams must recognise that standard scanning is insufficient for AI assets. Organisations should evaluate whether their current AppSec tools cover agent instructions and intent. JFrog suggests that solutions must scan for the purpose behind the code, not just the code itself. Teams need to identify four specific threat classes in their environments: prompt injection, hidden instructions, obfuscated payloads, and credential exfiltration. Without dedicated scanning for these intent-based risks, developers remain exposed to silent data theft.
Patch priority
Teams usually begin by identifying which systems utilise AI coding agents and what skills they have installed. Check whether current scanning tools explicitly support Markdown-based instruction analysis or agent plugin formats. Back up existing agent configurations before making changes to avoid disrupting developer workflows. Reduce exposure by restricting the installation of skills from unverified marketplaces until a dedicated scanning solution is in place. Verify that secret scanners are configured to inspect the context in which agents operate, not just the static files.
Background: Prompt injection attacks
Prompt injection prevention requires separating trusted system instructions from untrusted user inputs through strict structural boundaries. You must treat all model inputs as potentially malicious code rather than benign text. Implement strict structural formatting so the model can distinguish commands from data.
Read the full guide: Prompt injection attacks prevention checklist for secure systems
What to do and how to stay safe: JFrog
- Audit existing AI agent configurations to identify installed skills, plugins, and APM packages that may contain hidden instructions.
- Review scanning tool documentation to confirm whether they analyse Markdown files for malicious intent or credential exfiltration patterns.
- Implement strict approval processes for installing new agent skills from external marketplaces or unverified sources.
- Monitor agent logs for unusual behaviour, such as unexpected credential access or data transmission, which may indicate a successful evasion.
Step-by-step guide: Patch Management: Definition, Purpose and Operational Reality
General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Why do standard security scanners miss these AI asset threats?
Standard tools like SCA and SAST are designed for code and dependencies, but AI assets like SKILL.md files contain instructions and intent that these tools cannot trace or resolve.
Is there a CVE for these AI skill vulnerabilities?
No, there is no CVE because the malicious instructions are classified as valid Markdown, which static scanners typically treat as safe text rather than executable code.
How effective were the evasion techniques in the JFrog study?
The strongest evasion technique tested bypassed eight different scanners more than 90% of the time while still executing malicious tasks successfully inside production agents.
