Open-source gateway cuts attacks from malicious AI agent skills

A ten-author team, whose institutional affiliation the paper does not state, published ClawSentry, an open-source security gateway meant to sit between an AI coding agent and the “skills” — reusable packaged instructions and tool configurations — it draws on at runtime. The paper responds to a problem that has grown with the rapid adoption of shared agent-skill libraries: a skill can carry a prompt-injection payload that only activates once installed, and a filter that checks a skill once before use can be evaded by an attacker who alters behaviour mid-session.

ClawSentry works in three stages: auditing a skill package before it is allowed to run, applying tiered runtime checks — a fast deterministic layer plus a slower semantic review — to instructions and tool calls as the agent executes, and monitoring for attempts to bypass those checks within a single session rather than assuming an agent stays safe once cleared. The authors tested it against the SkillInject benchmark for malicious-skill attacks, run across four agent tools — Codex, Claude Code, Kimi CLI and Gemini CLI — to demonstrate the gateway works independently of which vendor’s agent it protects. They reported that contextual attack success fell from 39.55% to 2.61% with the gateway active, while ordinary, legitimate agent tasks kept completing at rates close to an unprotected baseline.

The paper is one of several published in August 2026 on the security of agent “skills” specifically. It followed by two weeks Vercel and OpenAI’s shared packaging standard for this kind of reusable extension, and sits alongside a broader wave of papers on computer-using-agent attacks published earlier the same month. A separate study published five days later reported that a single malicious skill could multiply as it spread through a shared library.