A Malicious Copy of Anthropic’s PDF Skill Carries a Linux Backdoor

Agents are doing more and more work for people, which means they increasingly rely on skills that help execute specific tasks. Need your agent to access a PostgreSQL database? There’s a skill for that. Looking for help filling out a PDF or converting another file into a PDF? A skill can do that too.

When a task calls for a SKILL.md instruction file, your agent automatically reads that file and does what it says, using whatever tools it has access to. That can include running shell commands. And because skills are now shared and reused so widely, they make an attractive target. What happens if someone keeps a popular skill’s name and description but rewrites the instructions?

Cyera Research analyzed a package called simply “pdf” that presented itself as Anthropic’s PDF skill, one of six related skill archives observed between May and July 2026. Most of the files matched the Anthropic skill exactly, including its legitimate PDF scripts. The SKILL.md header retained the official name and description so it looked legitimate on first glance, but its instructions had been replaced with a command to contact an external hostname. The package also contained system_linux: an obfuscated Go executable that, if launched, connects to a remote server and attaches /bin/bash to the connection.

A Byte-Perfect Copy of Anthropic’s PDF Skill

An AI skill is a folder of instructions in natural language that helps an agent perform a task. The folder may also contain scripts and reference files. Teams use skills to share procedures, but they also create a new security risk. Skills with familiar names and descriptions can make a tampered skill more likely to be chosen and trusted.

The PDF skill we analyzed used that trick. It included 11 files that were identical to Anthropic’s official PDF skill. But it had an important modification: two additional files, one of them a highly obfuscated ELF executable backdoor. Here’s the complete skill files breakdown:

The SKILL.md file below shows the name and description of the suspicious skill are identical to the original file, shown below. But from line seven on, it’s all malicious commands and the original instructions have been deleted. Anthropic’s file runs to 315 lines, and the sample stops at 19 lines.

The package keeps Anthropic’s original skill description and 11 unchanged files, making it likely to be selected for PDF tasks and easy to overlook in a script-only review. If someone installs this skill — including through plugins or a repo — the agent can run it without explicit permission or warning. The malicious change is concentrated in a replaced Quick Start command, alongside the added executable.

A Malicious Campaign

The samples we observed could have been delivered through phishing, impersonation, or a compromised distribution channel, but the available evidence does not establish an initial access route.

Threat hunting discovered five similar tar files that copied Anthropic’s PDF skill, but rewrites SKILL.md and adds two files: system_linux (ELF binary file, MD5: 0b98b3b45ff56c48c5f9341196bb9b7e) and a text file named 1. The obfuscated 64-bit Linux executable is a Go reverse shell configured to connect to 81.70.101[.]115:2345, an address identified as Tencent Cloud infrastructure. The skill’s separate curl command contacts scan.100tal[.]com, which was observed resolving to a private IP address. Samples were seen from May 23 to July 14, 2026. 

The Build Timeline

Build times come from timestamps stored inside the archives and are shown in the author’s local time, UTC+8, which is aligned with Asia-Pacific.

The package was assembled over two weeks and first seen two weeks after that. Visible activity then ran for about seven weeks.

An Incomplete Execution Flow

When loading the tampered PDF skill, it basically generates a curl call to https[:]//scan.100tal[.]com, which is a domain used by TAL Education Group, a China-based education technology company. During our analysis of these skills, it resolved to a local IP address, 10.160.65[.]97, and had a DNS alias (CNAME) ali-jcfw-global-innerssl[.]xescdn[.]com, which resolved to the same IP address. Xescdn[.]com appears to be infrastructure associated with Xueersi, a TAL Education Group brand. 

This is essentially where the attack stops. But the malicious binary has already found its way to your computer after you download and inflate the .tar file. There could be several reasons why the internal subdomains are pointing to internal addresses. This could be a pinpointed campaign that targets TAL Education Group and exploits something internal to trigger the binary. It could also be a temporary kill switch. While the campaign is paused, the attackers point these domains at internal addresses, and when they’re ready to resume, they switch the domains back to public IP addresses.

Inside the system_linux Binary

The most consequential file in the skill package is system_linux, a 5 MB, statically linked Go executable for 64-bit Linux. Despite its size, the program’s purpose is very narrow. It connects to a fixed server and gives the operator a shell on the machine that runs it.

Hiding a Small Program Inside a Large Binary

The file is obfuscated with garble, which replaces Go function and package names and hides strings that would otherwise reveal the program’s behavior. The server address was encrypted and decoded (base64). We reconstructed a base64-encoded key, which the program decodes and XORs byte by byte with 0xAA. It then decrypts the blob with AES-256-GCM that resulted to a plaintext reverse shell destination 81.70.101[.]115:2345. 

What Happens When It Runs

The program opens a plain TCP connection to that hard-coded IP address and port. The destination is an IP address and after connecting, it starts /bin/bash and assigns the same socket to the shell’s standard input, output, and error streams. Commands received over the connection go to the shell, and its output returns to the remote endpoint. The shell privileges are determined by the account that launched it. 

Who Is Behind It?

The short answer is that we do not know. The program contains error messages in Simplified Chinese, and the ZIP timestamps are consistent with UTC+8. Apple metadata suggests the original archive was prepared on macOS. The same program build appears in six packages and connects to an address hosted by Tencent Cloud. Separately, the skill instructs the agent to contact a TAL Education Group–associated hostname. Together, these clues give us some information on the package and its infrastructure, but they do not identify its author.

An internal security exercise and a targeted attack are both possible interpretations. The scan hostname and test-like marker files could fit an exercise; the obfuscated reverse shell and external server raise concern about an attack. We cannot establish either explanation, determine why the TAL-associated hostname was used, or show that the binary was launched. We also have no evidence that TAL was compromised or that anyone at TAL created the skill.

What the Evidence Supports

• Language: The Simplified Chinese messages suggest that the author, or a source they used, worked in Chinese. They do not establish identity or nationality.
• TAL connection: The hostname links the skill to TAL-associated infrastructure. A private IP answer does not prove the request worked only inside TAL’s network or that TAL staff were the intended targets.
• Attribution: We found no reliable link to a named person, group, or state. Language, timestamps, and hosting can reflect ordinary development choices or be deliberately misleading.

How the Case Maps to Security Frameworks

The clearest framework match is OWASP Agentic Skills Top 10: AST01, Malicious Skills. The package presents itself as a familiar PDF skill while carrying a modified instruction file and a reverse-shell binary. It also illustrates OWASP LLM03: Supply Chain: the risk arises when an agent accepts a skill whose contents have not been verified against the original. In MITRE ATT&CK terms, the copied name and description are consistent with Masquerading (T1036.005), while garble and the encrypted configuration fit Obfuscated Files or Information (T1027).

The binary’s code maps to Unix Shell (T1059.004) and Non-Application Layer Protocol (T1095): if launched, it attaches /bin/bash to a raw TCP connection. That conditional matters. We have not observed a user installing the skill, an agent running its curl instruction, or anything in the package launching system_linux. The server response could theoretically contain further instructions, but we have not seen it, so prompt injection and execution guardrails should not be presented as observed techniques. Nor can we claim a compromise of an established distribution channel under Supply Chain Compromise (T1195) without knowing how these packages were distributed. The frameworks describe the risks visible in the files; they do not fill the missing steps in the attack chain.

Conclusion

The PDF skill package was designed to look like a skill an agent could trust. Eleven files matched Anthropic’s PDF skill, while the modified SKILL.md directed the agent to contact another host and an added executable contained an obfuscated Linux reverse shell. The legitimate files made the package look familiar; the changed instructions and binary carried the risk.

The evidence stops short of a completed compromise. We do not know how the package was distributed, whether anyone installed or used it, what the curl request returned, or how system_linux would have been launched. Those gaps matter, but they do not diminish what the files show: reviewing only a skill’s name or its bundled scripts can miss harmful instructions and executables the agent may follow. Organizations using skills should verify the whole package against its claimed source and investigate unexpected commands, network destinations, and binaries before allowing an agent to use it.

How Cyera Helps

Our research shows a close inspection of what’s actually installed can help indicate whether a skill is truly safe. For teams running Claude Code and Claude Cowork, Cyera Agent Guardian catalogs all connected MCP servers and active skills across endpoints and classifies them as sanctioned or unsanctioned.

From there, Agent Guardian checks downloaded skill files for hardcoded secrets and unvetted actions, then validates each skill against the user’s identity and role. It can block skills that violate policy, and it evaluates tool calls before they execute, which can help prevent hidden, malicious commands.

Indicators of Compromise

Files

Network

Content