One command turns any open-source repo into an AI agent backdoor. OpenClaw proved no supply-chain scanner has a detection category for it
Just two months ago, researchers at the Data Intelligence Lab at the University of Hong Kong introduced CLI-Anything, a new state-of-the-art tool that analyzes any repo’s source code and generates a structured command line interface (CLI) that AI coding agents can operate with a single command.
Claude Code, Codex, OpenClaw, Cursor, and GitHub Copilot CLI are all supported, and since its launch in March, CLI‑Anything has climbed to more than 30,000 GitHub stars.
But the same mechanism that makes software agent-native opens the door to agent-level poisoning. The attack community is already discussing the implications on X and security forums, translating CLI-Anything's architecture into offensive playbooks.
The security problem is not what CLI-Anything does. It is what CLI-Anything represents.
CLI-Anything generates SKILL.md files, the same instruction-layer artifacts that Snyk’s ToxicSkills researchfound laced with 76 confirmed malicious payloads across ClawHub and skills.sh in February 2026. A poisoned skill definition...
Copyright of this story solely belongs to venturebeat.com. To see the full text click HERE
