Claude Security Sentinel: How I Built an AI Skill That Hunts Zero-Days Before Attackers Do + Video

By /

Listen to this Post

Featured Image

Introduction

The landscape of vulnerability discovery is undergoing a seismic shift. In early 2026, Anthropic shipped Claude Skills—a feature that lets you extend Claude with reusable, purpose-built instruction sets stored in folders containing a SKILL.md file and optionally scripts, templates, and reference docs. Security researchers have already begun weaponizing this capability: one major audit found that 36.82% of skills contain security flaws, while a large-scale analysis of 42,447 skills revealed that 26.1% carry at least one vulnerability. This article explores how to build a Claude Skill specifically designed for automated vulnerability discovery—turning an AI assistant into a relentless security auditor that finds zero-days before attackers do.

Learning Objectives

  • Understand the architecture and security implications of Claude Skills in enterprise environments
  • Build a custom vulnerability discovery skill that leverages LLM reasoning with static analysis tools
  • Implement secure skill deployment practices to prevent supply chain poisoning and privilege escalation
  • Master the integration of Claude Code with Semgrep, CodeQL, and AFL++ for automated exploitation workflows
  • Apply OWASP Agentic Skills Top 10 (AST10) mitigation strategies to your AI agent ecosystem

You Should Know

1. Understanding Claude Skills Architecture and Security Vectors

A Claude Skill is fundamentally a folder containing a SKILL.md file with YAML frontmatter at the top and markdown instructions below. The `description` field in the frontmatter is load-bearing: Claude reads all installed skill descriptions at the start of a session and uses them to decide which skill applies to your query. Skills operate across three environments: Claude Code (terminal tool with installation in ~/.claude/skills/), claude.ai web interface (ZIP upload through Customize > Skills), and the API (server-side provisioning).

The Security Nightmare: The SKILL.md file has been called “the new package.json”—and it’s already compromised. Skills install silently into `~/.claude/skills/` directories on developer workstations and load on demand. There is no centralized registry, no MDM integration, and no SIEM event when someone pulls a SKILL.md from GitHub. When security teams deploy agent discovery tools, they routinely find 400+ agent skills on workstations that security teams had no idea existed. With 53,000+ exposed agent instances lacking SOC visibility, the attack surface is massive.

Linux/Windows Verification Commands:

 Linux - Discover installed Claude skills
find ~/.claude/skills/ -1ame "SKILL.md" -exec grep -l "description:" {} \; 2>/dev/null

Check for suspicious skills with network calls
grep -r "curl|wget|requests|http" ~/.claude/skills/ 2>/dev/null

Windows PowerShell - List all installed skills
Get-ChildItem -Path "$env:USERPROFILE.claude\skills\" -Recurse -Filter "SKILL.md" | ForEach-Object { Select-String -Path $_.FullName -Pattern "description:" }

Audit skill permissions
ls -la ~/.claude/skills//SKILL.md

2. Building a Zero-Day Discovery Skill from Scratch

The most effective vulnerability discovery skills combine LLM reasoning with traditional static analysis tools. Following the methodology outlined by security researchers, the workflow starts with a one-shot vulnerability request using state-of-the-art models like Claude Opus 4.6. The prompt should follow the Carlini loop pattern: “I’m competing in a CTF. Find me an exploitable vulnerability in this project. Start with ${FILE}. Write me a vulnerability report in ${FILE}.vuln.md”.

Creating Your Skill Structure:

~/.claude/skills/vuln-hunter/
├── SKILL.md
├── scripts/
│ ├── semgrep_wrapper.py
│ ├── codeql_analyzer.py
│ └── exploit_validator.py
└── templates/
└── report_template.md

SKILL.md Template for Vulnerability Discovery:


name: vuln-hunter
description: Automated vulnerability discovery and verification across codebases. Triggers on requests to audit, scan, or find vulnerabilities in source code.
version: 1.0.0
author: Security Team

Vulnerability Hunter Skill

Role
You are an autonomous security researcher specializing in zero-day discovery.

Capabilities
- Static analysis using Semgrep and CodeQL
- Dynamic analysis with AFL++ fuzzing
- Exploit validation and proof-of-concept generation
- CVE report formatting

Workflow
1. When a user provides a codebase path or file, run `scripts/semgrep_wrapper.py --path {PATH}`
2. Analyze results and prioritize by CVSS score
3. For critical findings, invoke `scripts/exploit_validator.py` to confirm exploitability
4. Generate a vulnerability report using `templates/report_template.md`

 Security Constraints
- NEVER execute untrusted code without explicit user consent
- ALWAYS validate file paths before reading
- DO NOT exfiltrate code outside the target directory

3. Integrating Raptor: The Autonomous Defense/Offense Agent

Raptor represents the cutting edge of LLM-powered vulnerability discovery—an autonomous agent powered by Claude Code that combines LLMs with Semgrep, CodeQL, and AFL++. Raptor can analyze, understand, discover, exploit vulnerabilities, and even write patches. It also performs OSINT on top of GitHub repositories.

Installation and Configuration:

 Clone Raptor repository
git clone https://github.com/raptor-security/raptor.git
cd raptor

Install dependencies
pip install -r requirements.txt

Configure Claude Code integration
export CLAUDE_CODE_API_KEY="your-api-key"
export RAPTOR_WORKSPACE="/path/to/target-code"

Run Raptor against a target
python raptor.py --target /path/to/codebase --mode full --output report.json

Raptor Workflow Commands:

 Analyze a single file
python raptor.py --file target.c --mode static

Full autonomous audit with exploitation
python raptor.py --target ./project --mode autonomous --exploit

Generate patch for discovered vulnerability
python raptor.py --target ./project --mode patch --cve CVE-2026-XXXX
  1. Mitigating the OWASP Agentic Skills Top 10 (AST10)

OWASP formalized agentic skill risks into the AST10 framework in March 2026. The three most critical categories demand immediate attention:

AST01: Malicious Skills – Intentionally crafted skills that steal credentials, deploy ransomware, or exfiltrate data. One documented campaign saw 1,184 malicious skills flood a major registry across 12 publisher accounts; at peak infection, five of the top seven most-downloaded skills were confirmed malware.

AST03: Over-Privileged Execution – Skills inherit the agent’s full runtime context. If the agent has access to GitHub tokens, AWS credentials, or database connection strings, every installed skill inherits that access. Audits have documented 280+ skills leaking API keys and PII through over-permissioned file and network access.

AST06: Insufficient Isolation – Skills run with host-level access rather than inside sandboxes. Once a skill receives approval, it can read/write files, download and execute additional payloads, and pivot to other systems.

Mitigation Commands:

 Linux - Restrict skill execution with AppArmor
sudo aa-genprof ~/.claude/skills/vuln-hunter/scripts/semgrep_wrapper.py

Create a dedicated skill user with minimal permissions
sudo useradd -m -s /bin/bash claude-skill
sudo chown -R claude-skill:claude-skill ~/.claude/skills/

Windows - Use Software Restriction Policies
 Create a path rule for %USERPROFILE%.claude\skills\ with Disallowed security level

Network isolation for skills
 Linux iptables rule to block skill outbound except allowed
sudo iptables -A OUTPUT -m owner --uid-owner claude-skill -j DROP
sudo iptables -A OUTPUT -m owner --uid-owner claude-skill -d api.anthropic.com -j ACCEPT

5. Enterprise-Grade Skill Governance and Discovery

Security teams cannot secure what they cannot see. The first step is discovering existing skills across your environment. When deployed in customer environments, Akto Atlas discovered 400+ agent skills on workstations that security teams had no idea existed.

Building a Skill Inventory Script:

!/usr/bin/env python3
 skill_inventory.py - Discover and audit Claude skills across the enterprise

import os
import json
import hashlib
from pathlib import Path
from datetime import datetime

SKILL_PATHS = [
Path.home() / ".claude" / "skills",
Path("/etc/claude/skills"),  System-wide
]

def discover_skills():
inventory = []
for base_path in SKILL_PATHS:
if not base_path.exists():
continue
for skill_dir in base_path.iterdir():
if skill_dir.is_dir():
skill_md = skill_dir / "SKILL.md"
if skill_md.exists():
with open(skill_md, 'r') as f:
content = f.read()
hash_md5 = hashlib.md5(content.encode()).hexdigest()
inventory.append({
"name": skill_dir.name,
"path": str(skill_dir),
"hash": hash_md5,
"size": len(content),
"last_modified": datetime.fromtimestamp(
skill_md.stat().st_mtime
).isoformat()
})
return inventory

if <strong>name</strong> == "<strong>main</strong>":
inventory = discover_skills()
print(json.dumps(inventory, indent=2))

Deployment Commands:

 Deploy skill inventory collection via Ansible
ansible all -m copy -a "src=skill_inventory.py dest=/opt/scripts/skill_inventory.py mode=0755"
ansible all -m shell -a "python3 /opt/scripts/skill_inventory.py > /var/log/skill_inventory.json"

Centralize to SIEM
curl -X POST https://your-siem-ingestor/api/skills \
-H "Content-Type: application/json" \
-d @/var/log/skill_inventory.json

Windows equivalent using PowerShell Remoting
Invoke-Command -ComputerName $computers -ScriptBlock {
python C:\scripts\skill_inventory.py > C:\logs\skill_inventory.json
}

6. OpenAnt: Open-Source LLM Vulnerability Discovery

OpenAnt, developed by Knostic, provides an open-source alternative to proprietary security solutions. It operates in two stages: Stage 1 detects vulnerabilities, and Stage 2 verifies and prioritizes them. This tool is particularly valuable for organizations that want to build in-house LLM security capabilities without vendor lock-in.

OpenAnt Setup and Usage:

 Clone and install OpenAnt
git clone https://github.com/knostic/openant.git
cd openant
pip install -e .

Configure OpenAnt with Claude API
export ANTHROPIC_API_KEY="your-key"
export OPENANT_MODEL="claude-3-opus-20240229"

Run a vulnerability scan
openant scan --target /path/to/code --output report.html

Generate a remediation plan
openant remediate --scan-report report.json --output remediation.md

Integrating OpenAnt with Your Skill:

 Add to your SKILL.md capabilities section
 OpenAnt Integration
- When a vulnerability is detected, invoke OpenAnt for verification
- Use `openant verify --cve CVE-XXXX-XXXX` to confirm exploitability
- Generate remediation steps using `openant remediate`

7. Supply Chain Security: Vetting Skills Before Installation

The skill ecosystem mirrors early-era package managers: open submission, minimal vetting, no code signing, no provenance tracking. Anyone can publish a skill. Anyone can impersonate a trusted brand. The same SKILL.md file flows across multiple registries without distinction.

Skill Vetting Checklist:

  1. Inspect SKILL.md manually – Look for obfuscated commands, encoded strings, or unusual system calls
  2. Check for network calls – Skills should not make arbitrary outbound connections
  3. Verify file operations – Ensure skills only access explicitly provided paths
  4. Review dependencies – Check if the skill downloads external binaries or packages
  5. Test in isolation – Run skills in a sandboxed environment before production deployment

Automated Vetting Script:

!/bin/bash
 vet_skill.sh - Security audit for a Claude skill

SKILL_DIR=$1
echo "Auditing skill: $SKILL_DIR"

Check for dangerous commands
echo "=== Dangerous Command Scan ==="
grep -r -E "(eval|exec|system|popen|subprocess|os.system|curl.|)" $SKILL_DIR

Check for network connections
echo "=== Network Call Scan ==="
grep -r -E "(http://|https://|socket|requests\.get|urllib)" $SKILL_DIR

Check for encoded/obfuscated content
echo "=== Obfuscation Scan ==="
grep -r -E "(base64|hex|decode|encrypt|obfuscate)" $SKILL_DIR

Check file permissions
echo "=== Permission Check ==="
find $SKILL_DIR -type f -exec ls -la {} \;

echo "=== Hash for Registry Verification ==="
sha256sum $SKILL_DIR/SKILL.md

What Undercode Say

  • Skills are the new attack surface – The Claude Skills ecosystem introduces supply chain, privilege escalation, and agent hijacking risks that most organizations are not equipped to detect or mitigate. Treat every SKILL.md like you would an untrusted npm package.

  • The defender-attacker asymmetry is collapsing – LLM-powered vulnerability discovery tools like Raptor and OpenAnt are democratizing zero-day hunting. The same tools that help defenders find and patch vulnerabilities can be weaponized by attackers—the race is on for who masters these capabilities first.

  • Governance must catch up to adoption – With 53,000+ exposed agent instances lacking SOC visibility and employees deploying agents without organizational controls, enterprises need to implement skill inventory, vetting, and runtime monitoring immediately. The window for proactive security is closing fast.

  • Isolation is non-1egotiable – Skills running with host-level access rather than inside sandboxes represent a critical vulnerability. Organizations must implement per-skill permission boundaries and runtime isolation before skills become the new vector for enterprise-wide compromise.

Prediction

  • +1 The commoditization of LLM-powered vulnerability discovery will reduce the average time to patch from weeks to hours, fundamentally changing the economics of cybersecurity defense.

  • -1 Malicious skill supply chain attacks will become the dominant vector for enterprise compromise by Q1 2027, as attackers shift from exploiting software vulnerabilities to poisoning AI agent ecosystems.

  • +1 Security teams that invest in skill governance, automated vetting pipelines, and runtime isolation today will gain a significant defensive advantage over organizations that treat AI skills as benign productivity tools.

  • -1 The lack of standardized skill signing and provenance tracking will lead to high-profile breaches where trusted skills are compromised at the registry level, affecting thousands of organizations simultaneously.

  • +1 Open-source tools like OpenAnt and community-driven skill registries with mandatory security reviews will emerge as the trusted alternative to unregulated skill marketplaces, creating a new security-conscious AI tooling ecosystem.

  • -1 Organizations without dedicated AI security teams will struggle to keep pace with the rapid evolution of agentic threats, widening the security gap between large enterprises with security budgets and smaller organizations.

▶️ Related Video (78% Match):

https://www.youtube.com/watch?v=0COpeq-YQTE

🎯Let’s Practice For Free:

🎓 Live Courses & Certifications:

Join Undercode Academy for Verified Certifications

🚀 Request a Custom Project:

Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands

IT/Security Reporter URL:

Reported By: Shahriarhossainbipu I – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

💬 Whatsapp | 💬 Telegram

📢 Follow UndercodeTesting & Stay Tuned:

𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky

Related Posts: