All eight open-source AI skill scanners can be bypassed by malicious skills

Adversa AI tested eight open-source Agent skill scanners with real attack payloads (against SKILL.md, agent manifests, and MCP configurations loaded by Claude Code and others), and all malicious skills passed, including HMA, currently ranked first on the OASB leaderboard. The bypass reasons vary: six can be bypassed by rewriting or obfuscation, one performs almost no checks, and one's decision file itself can be injected with instructions. A common flaw is the lack of front-end processing: all scanners match file bytes rather than actually executed bytes, none decode encoded payloads and rerun the full rule set, and none perform Unicode normalization before running the command library.