Vulnerability Description
claude-skill-antivirus fails to analyze executable files when scanning local skill directories, reading only SKILL.md while ignoring Python source, bytecode, and other artifacts in the scripts directory. Attackers can distribute skills with malicious code in non-manifest files that receive a SAFE verdict with 100/100 trust score despite containing unanalyzed executable payloads.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/claude-world/claude-skill-antivirus
- https://github.com/claude-world/claude-skill-antivirus/blob/v2.1.3/src/scanner/i
- https://github.com/claude-world/claude-skill-antivirus/blob/v2.1.3/src/utils/dow
- https://github.com/claude-world/claude-skill-antivirus/issues/33
- https://www.vulncheck.com/advisories/claude-skill-antivirus-analysis-bypass-via-
- https://github.com/nedlir/skills-scanner-bypass
FAQ
What is CVE-2026-84810?
CVE-2026-84810 is a vulnerability with a CVSS score of 6.5 (MEDIUM). claude-skill-antivirus fails to analyze executable files when scanning local skill directories, reading only SKILL.md while ignoring Python source, bytecode, and other artifacts in the scripts directo...
How severe is CVE-2026-84810?
CVE-2026-84810 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-84810?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.