Payload re-download triggered by poisoned Claude SKILL.md skill file

Ibrahim Saud@tektrix

•updated Sep 23, 2026•1•0•6

Detects potential malicious activity where a process associated with a Claude agent (or a downloader utility) references a 'SKILL.md' configuration file. This behavior is indicative of a poisoned skill file being used to trigger unauthorized payload downloads or re-establish persistence.