Static analysis nailed the malicious skill and over-flagged the useful one. The gap between those results is where human judgement actually earns its keep.
Machine-generated by The Flow from the publisher's headline and feed description — not written or checked by a human. The full article lives at Towards Data Science.
arXiv:2606. 01494v1 Announce Type: cross Abstract: Agent skills extend AI agents with reusable instructions, tools, scripts, references, and workflows, establishing a security boundary distinct from both model safety and traditional package-malware detection.
arXiv:2606. 11671v1 Announce Type: cross Abstract: Agent skills let LLM agents reuse instructions, resources, tools, and workflows, but they also create a new place for malicious behavior to hide.
arXiv:2609.13353v1 Announce Type: cross Abstract: Agent skills are reusable units for language-model agents, but their risks emerge through model decisions, user context, tool calls, and execution fe...
arXiv:2610.17727v2 Announce Type: cross Abstract: Agent skills turn natural-language instructions into actions, creating a security challenge: legitimate automation and malicious behaviour can look d...
The paper introduces a six‑module scanner for detecting unintended local and composite vulnerabilities in LLM‑based agent skills. Local Analysis achieved high recall and precision on benchmark datasets, outperforming existing scanners, while Composite Analysis accurately modeled inter‑skill dependencies and identified composite flaws. The authors validated findings with proof‑of‑concept attacks, disclosed cases to maintainers, and demonstrated effective mitigations that preserved legitimate functionality.
The paper titled "Pretext: Defeating Malicious Skill Detection Frameworks for AI Agents" demonstrates how an attacker can bypass current skill‑scanning defenses by crafting malicious skills that evade both static analysis and LLM‑based semantic checks. By moving malicious payloads into natural language and distributing instructions across files, the white‑box attacker named Pretext achieves high evasion rates—up to 97% against a frozen detector and 77% against a co‑adaptive one—across three open‑source models.