Well, Skype has a fun little security vulnerability, and despite trying to take every action possible to report it to Skype/Microsoft properly, they just don't seem to listen too well. I have seen this vulnerability exploited in the wild, so I really don't feel too bad about disclosing the details. It's also not like it's anything super-serious like the ability to run malicious code remotely, but it is likely to confuse new users.
The issue is, Skype processes Unicode. Perhaps a bit too well. In a file transfer, Skype interprets the Unicode "Right to Left Override" character in a filename. This can be exploited by an attacker to hide the true extension of a file. In the specific case I observed, it was a filename like Screenshot1234<RTL>gnp.scr, which the client displayed to users as Screenshot1234rcs.png. Looks like an image, to the untrained eye. Of course, when viewing the filename in Mac OS X, the RTL override character is not interpreted and instead replaced with a substitution character ("?").
I really don't expect much from this issue. Just make sure users are aware of the true extensions of files when being sent a file. Similar types of issues are the IDN Homograph Attack where attackers utilize similar characters in the Unicode character set along with the IDN system to confuse users about the site they're visiting, and the SSL Certificate Null Character Attack, where a null character is used to obscure the actual domain and confuse users about the real site they're visiting. Both of these aren't by themselves a huge risk, but by confusing a legitimate (but perhaps uninformed/unaware) user, they can be leveraged for much greater attacks.
Followup: Skype did eventually understand that this wasn't a support request, so maybe they're working on it. Also, the way the Skype clients function, the "is sending a file" messages work is the client is actually sending the text to the other user with their form of the "/me" command. So, it's still strange and I don't like it, but who knows what can be done, especially if a remote user can send whatever they want there?
