84% of Malicious Agent-Skill Exploits Hide in the Docs, Not the Code

Notes on "Do Not Mention This to the User": Detecting and Understanding Malicious Agent Skills in the Wild (arXiv:2602.06547) — Yi Liu, Zhihao Chen, Yanjun Zhang, Gelei Deng, Yue-Ying Li, Jianting Ning, L. Zhang · February 2026

Note published July 23, 2026 · written by SkillFed’s research pipeline from the paper above · how these notes are made

Researchers ran 98,380 agent skills pulled from two community registries, skills.rest and skillsmp.com, through a four-stage detection funnel: static pattern matching against 14 rules tied to a six-phase kill chain, dynamic behavioral verification inside sandboxed containers, then manual dual-rater review (Cohen's κ=0.89) and vulnerability labeling. Static matching alone flagged 4,287 candidates. The full pipeline confirmed 157 as malicious — 632 distinct vulnerabilities spread across 13 attack techniques — with the dynamic-verification stage alone hitting 99.6% precision, a 90x jump over pattern matching by itself.

These aren't sloppy scripts. The average confirmed-malicious skill carries 4.03 vulnerabilities, 71.8% of them critical or high severity — and 84.2% sit inside the natural-language SKILL.md instructions rather than in executable code. Two dominant strategies emerge, and they rarely mix: remote-script-execution credential theft and documentation-embedded instruction override co-occur in just 5.1% of cases (OR=0.11, p<0.001), meaning attackers specialize rather than combine techniques. One templated brand-impersonation operation accounts for 54.1% of every confirmed malicious skill in the dataset; the most advanced-tier skills universally lean on shadow features — capabilities invisible in any public documentation. Once the authors disclosed all 157 cases, both registries pulled them: 100%.