CVE-2026-84810: Protection Mechanism Failure in claude-world claude-skill-antivirus

The claude-skill-antivirus component of claude-world does not properly analyze executable files when scanning local skill directories. It reads only the SKILL.md manifest file and ignores other script files such as Python source and bytecode. Consequently, malicious code can be hidden in these unanalyzed files, which are incorrectly assigned a SAFE verdict with a 100/100 trust score. This represents a protection mechanism failure allowing potentially malicious payloads to evade detection. The affected versions are from 0 through 2.1.3 inclusive. There is no information on available patches or vendor advisories.

Attackers can distribute skills containing malicious executable payloads in non-manifest files that are not analyzed by the antivirus. These files receive a SAFE verdict with maximum trust, enabling execution of malicious code despite the antivirus verdict. This could lead to compromise of systems relying on claude-skill-antivirus for protection against malicious skills.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when installing or running skills from untrusted sources, as the antivirus may not detect malicious code hidden outside the manifest file.