CVE-2026-84810 claude-world CVE debrief

Who should care

Defenders responsible for managing and securing skills and their contents should be aware of this vulnerability. They should assess exposure and prioritize verification of skill integrity to prevent potential malicious code execution.

Why it matters

CVE-2026-84810 allows attackers to bypass analysis of executable files in skill directories, posing a risk to defenders who do not verify skill integrity.

• Defenders must verify skill integrity to prevent potential malicious code execution.
• Additional scanning mechanisms are required to analyze executable files within skill directories.
• The antivirus' scanning logic needs review and update to include Python source, bytecode, and other artifacts in the scripts directory.

Technical summary

The claude-skill-antivirus fails to analyze executable files when scanning local skill directories. It only reads SKILL.md and ignores Python source, bytecode, and other artifacts in the scripts directory. This allows attackers to distribute skills with malicious code in non-manifest files that receive a SAFE verdict with 100/100 trust score despite containing unanalyzed executable payloads. The issue arises from incomplete scanning logic, which defenders should review and update to include all relevant files. Defenders should prioritize verifying the integrity of skills and their contents to prevent potential malicious code execution.

Defensive priority

Defenders should prioritize verifying the integrity of skills and their contents, ensuring that all files within a skill directory are properly scanned for malicious code.

Recommended defensive actions

• Verify the integrity of skills and their contents to ensure all files are properly scanned for malicious code.
• Implement additional scanning mechanisms to analyze executable files within skill directories.
• Review and update the antivirus' scanning logic to include Python source, bytecode, and other artifacts in the scripts directory.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but the scope of affected versions and remediation steps require verification from the supplied official sources. The claude-skill-antivirus repository and specific files like scanner/index.js and utils/downloader.js may contain additional information. However, without direct access to these resources, defenders must rely on publicly available data and verify skill integrity through other means. To ensure thorough verification, defenders should review the official CVE,

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.