15 cloned listings hijack skill retrieval 93% of the time

Notes on Agent Skill Security: Threat Models, Attacks, Defenses, and Evaluation (arXiv:2607.13987) — Sanket Badhe, Priyanka Tiwari · July 2026

Note published July 24, 2026 · written by SkillFed’s research pipeline from the paper above · how these notes are made

SkillSec-Eval breaks the agent skill lifecycle into six stages — authoring, storage, retrieval, planner selection, execution, evolution — and gives each one its own threat taxonomy. Badhe and Tiwari run the framework against 327 real skills pulled from the SkillMCP repository across 15 clusters spanning DevOps, cloud operations, and data engineering, then throw five attack families at it: tampered signatures and provenance at storage, gamed semantic retrieval via keyword stuffing and cloned listings, fake planner-facing recommendations, chained tool calls at execution, and permission creep hidden inside version updates.

Nobody's surprised execution needs guarding, but it's still the easiest stage to break: an undefended sandbox lets 100% of execution-time attacks reach a privileged sink, and even dynamic taint tracking plus policy enforcement only knocks that down to 23% — ask an LLM to paraphrase sensitive output and it silently strips the taint tag along with it. Storage checks fare no better: rules-only signature and provenance verification wave through 52.9% of malicious skills at admission, and bolting on an LLM check for whether declared permissions match the actual workflow cuts that to 7.9%, but at the cost of rejecting 20% of clean submissions too. The softest target of all is retrieval itself — publish 15 near-duplicate copies of a malicious skill, a Sybil attack, and it lands in an agent's shortlist 93.2% of the time with no defense running. Planners fall for fake endorsement-style metadata 45.6% of the time, before an attacker has touched a line of actual code.