Empirically Testing Skill Scanners Against Traditional Obfuscation

Introduction After skill repositories took the AI community by storm, the security concerns they dragged in made even louder headlines. To surf the hype bring more security to innocent users, several companies rushed to release security scanners built essentially on LLMs reading Markdown files and flagging suspicious patterns. In this context, I asked myself how these scanners would perform against traditional obfuscation techniques, given that they are essentially performing static analysis. Especially considering that according to 1 , “while LLMs can effectively reason about the code, obfuscation significantly reduces their ability to detect potential vulnerabilities.” So, would obfuscation be able to impact skill scanning in some way🤔? 💡 Key takeaways (or TL;DR) Skill scanners don’t like obfuscation through encoding and procedurization, but they can tolerate splitting/merging techniques. It seems Socket didn’t like the skill I picked for testing 😭 Are skill scanners using dynamic an