The vulnerability arises because claude‑skill‑antivirus scans only the SKILL.md manifest file when examining local skill directories, ignoring Python source, bytecode, and other executable artifacts that may reside in the scripts sub‑directory. An attacker can embed malicious code inside these non‑manifest files and distribute the skill package. The scanner nonetheless assigns a SAFE verdict with a perfect 100/100 trust score, effectively bypassing the intended antivirus check and allowing the malicious payload to execute on a system that trusts the skill.

All releases of the claude‑skill‑antivirus skill, including the v2.1.3 branch referenced in the advisory, are affected because the default analyzer performs manifest‑only scans. The vulnerability is present in any version that does not alter this scanning behavior to include executable files in the trust validation process.

The CVSS score of 7.1 indicates a high severity vulnerability that can lead to remote code execution if the skill is installed. Although the EPSS score is not available, the absence of a listed KEV status suggests that there is currently no widespread exploitation reported, but the use of community skill repositories provides an opportunity for attackers to distribute malicious skills. The attack likely requires indirect external access—by injecting a malicious skill into a distribution channel or by supplying a crafted skill package to a system—rather than a direct network exploit. The risk is amplified because the system will accept the safe verdict without inspecting the actual executable content.