Skill security 42 papers

Every note, newest paper first

1. 15 cloned listings hijack skill retrieval 93% of the time

   2026-07-15 — SkillSec-Eval breaks the agent skill lifecycle into six stages — authoring, storage, retrieval, planner selection, execution, evolution — and gives each one its own threat taxonomy. Badhe and…

2. Comparing a skill's claims to its code lifts misalignment detection from 0.45 to 0.89 Macro-F1

   2026-07-12 — SkillsMP, the largest open-source Agent Skills marketplace, supplied a corpus of 264,937 normalized skill packages out of 273,657 catalog entries, each split into three layers: metadata (name,…

3. 216,938 skills, and only 114,565 come with a paper trail

   2026-07-08 — SkillCenter builds its library through a five-stage pipeline. Source acquisition feeds an LLM-based pre-filter called SkillGate , which screens raw material for actionability before any generation…

4. Nearly 1 in 5 Skill Forks Add Security-Sensitive Instructions Bridge: security × benchmarks

   2026-07-03 — Researchers screened GitHub for agent skill repositories with at least 20,000 stars and 2,000 forks and landed on six, including Anthropic's own anthropics/skills, obra/superpowers, and…

5. Stack five skills, multiply hidden-intent risk 14x

   2026-07-02 — SkillFuzz treats skill composition — not the individual skill — as the unit worth testing. An LLM first compiles each skill's natural-language instructions into a structured skill contract :…

6. Whole-Trace Checking Catches 95.8% of Skill Policy Violations

   2026-06-25 — VIGIL is a runtime reference monitor for agent skills. It abstracts raw tool calls into typed events, then grounds each skill's natural-language specification into a policy that names the actual…

7. One skill's approval nod pushes malicious installs from 1% to 84% Bridge: security × benchmarks

   2026-06-13 — Security review for agent skills mostly happens one skill at a time — does this skill's code or manifest do anything dangerous, taken alone. Skill Composition Risk (SCR) names what that misses: a…

8. Best Skill Scanner Catches 17% of Cross-Modal Attacks — a Distilled 7B Model Hits 88% Bridge: security × benchmarks

   2026-06-12 — SkillMutator targets a blind spot in Agent Skills security: attacks that only emerge from how a skill's natural-language SKILL.md and its executable code interact, not from either file read on…

9. One disguised setup line hits 89.3% attack success — while scanners already false-flag 74.6% of clean skills

   2026-06-06 — POISE compromises a SKILL.md file by editing exactly one line. The earlier approach scattered several explicit malicious steps through a skill's body, giving an agent multiple chances to notice a…

10. The best skill scanner hits 98% recall — and still flags 937 of 4,000 safe skills as malicious Bridge: security × benchmarks

    2026-06-05 — MalSkillBench builds ground truth for detecting malicious agent skills — the SKILL.md packages that bundle natural-language instructions, scripts, and tool permissions for coding agents like Claude…

11. Permission gating nearly halves skill-injection success — 36.7% → 18.0%

    2026-06-02 — Agent skills aren't just documentation anymore — they're bundles of instructions, scripts, and tool bindings that can steer an agent's reasoning before any tool executes, then trigger real side…

12. A poisoned skill file compromises up to 86% of sessions that load it

    2026-06-01 — SkillHarm treats an agent skill as a persistent artifact with a lifecycle, not a one-shot instruction set, and builds its benchmark on that framing instead of testing poisoned skills inside one…

13. Agent-skill security scanners agree on just 0.69% of all skills — each is watching a different layer

    2026-05-31 — ClawHub Security Signals pairs each of 67,453 latest public OpenClaw skill versions — redacted SKILL.md content plus sanitized bundled files where present — with a ClawScan verdict (clean,…

14. Zero of 8 production agent systems verify skill-in-use

    2026-05-29 — Agent skills look solved from the outside: descriptors load, tools get pre-approved, marketplaces push updates. Underneath that surface, a systematic review of 37 production agent systems and 51…

15. 80% of agent skills in a 49,943-skill registry don't do what they claim — most of it is sloppiness, not malice Bridge: security × benchmarks

    2026-05-12 — Most skill safety work checks prompts and runtime actions, never the skill artifact itself against its own description. Behavioral integrity verification (BIV) names that missing check: a typed…

16. Metadata Alone Wins 86% of Skill-Discovery Matchups Bridge: security × retrieval

    2026-05-12 — SKILL.md files — the natural-language front matter that tells an agent when and how to use a packaged capability — sit upstream of three separate decisions: whether a skill gets found, whether it…

17. Zero malicious prompts, 50.3% attack success: poisoned skill files hijack agents anyway Bridge: security × benchmarks

    2026-05-12 — SkillSafetyBench tests a blind spot in agent safety evaluation: the user's request stays completely benign, but the exploit rides in through the skill itself. The benchmark packages 155 adversarial…

18. Over-privilege, not caution, causes 92–100% of agent skill failures Bridge: security × benchmarks

    2026-05-09 — FORTIS treats the skill layer — the abstraction that routes a request to a specific skill and then to specific tools — as a privilege boundary , not an organizational nicety. It scores two things…

19. Semgrep, refinement types, and Z3 turn a "formally verified skill" into a proof you can re-check yourself — minus one named gap

    2026-05-09 — Agent skills split into two halves: a deterministic script side that runs known code, and a non-deterministic LLM side that decides what to call next. This paper treats capability-containment —…

20. 97.6% of Injection and Poisoning Caught, Only 90.2% When Skills Interact

    2026-05-06 — SIGIL treats skill security as a lifecycle problem, not a one-time gate. Every approved skill gets anchored in a tamper-evident on-chain registry , published under one of four modes — Transparent…

21. A skill compiler lifts Claude Code pass rates from 21% to 33% — and catches a missing safety guard in 95% of real-world skills

    2026-05-05 — SkCC treats SKILL.md as source code, not the final artifact. A syntax parser lowers the raw markdown into a typed abstract syntax tree; an IR builder then normalizes that tree into SkIR, a…

22. More Than Half of 13,728 Real-World Skills Hide a Critical Risk in Plain Prose

    2026-05-01 — Every agent skill is two artifacts stapled together: a structured half that declares callable actions, and a prose half that tells the agent when to fire them — prose that gets reinterpreted fresh,…

23. SKILL.md alone catches 0% of malicious skills; the full package recovers 67%

    2026-04-28 — Agent Skills bundle a SKILL.md manifest with scripts, reference documents, and repository context, so auditing one before it loads means reviewing several files as a unit rather than screening a…

24. Wrapping a harmful request inside a skill file nearly triples model harm scores, from 0.27 to 0.76 Bridge: security × benchmarks

    2026-04-16 — HarmfulSkillBench starts as a sweep, not a benchmark: every one of the 98,440 skills published on ClawHub and Skills.Rest gets scored against a purpose-built harmful skill taxonomy -- cyber…

25. Malicious-Skill Detection Hits 0.920 F1 at $0.006 per Skill

    2026-04-08 — A regex scanner can read a skill's code but not the English prose in its SKILL.md — exactly where prompt injection and social-engineering instructions like to hide. Formal static analyzers read…

26. 1,184 skills fell in one campaign — because Agent Skills has no line between data and instructions

    2026-04-03 — Agent Skills — the filesystem-based packaging format that lets agents load domain-specific instructions and bundled scripts on demand — has never had a systematic security audit until now. This one…

27. A skill's own examples smuggle malicious code past agent defenses up to 33.5% of the time

    2026-04-03 — Coding agents install third-party agent skills from open marketplaces with no mandatory security review, and because those skills run as operational directives with system-level privileges — file…

28. Debug Logging Alone Causes 73.5% of Agent-Skill Credential Leaks

    2026-04-03 — Researchers built the first large-scale audit of credential leakage across a live agent-skill marketplace. Starting from 170,226 artifacts on SkillsMP, they drew a stratified random sample of…

29. 20,000 listed skills, 5,642 distinct: clone detection finds the catalog is 3.5x inflated

    2026-03-23 — SkillClone doesn't read a SKILL.md file as one flat document. It splits each into three channels — YAML frontmatter, natural-language instructions, and embedded code — and embeds each one separately…

30. 90% of a Skill Marketplace's Most-Downloaded Skills Fail a Rigorous Security Audit

    2026-03-22 — SkillProbe is a three-stage, multi-agent auditing pipeline built for agent skill marketplaces like ClawHub. First, a Gatekeeper stage filters for compliance violations and known-malicious patterns.…

31. Checking the repo, not just the SKILL.md, cuts flagged 'malicious' skills from 46.8% to 0.52%

    2026-03-17 — Researchers crawled 238,180 unique agent skills from ClawHub, Skills.sh, SkillDirectory, and GitHub — the largest cross-platform census of the skill ecosystem so far. Every skill passed through…

32. GitHub-mined skills teach 40% better, but 26% ship vulnerabilities Bridge: security × retrieval

    2026-03-12 — The pipeline mines open-source agentic repositories in three stages: structural analysis of a repo's layout, dense retrieval to find reusable procedural capabilities buried in the code, and…

33. A trojanized skill hit 9x token amplification — the failed run cost more than either successful one

    2026-03-01 — Clawdrain is a trojanized OpenClaw skill that hides a multi-turn "Segmented Verification Protocol" (SVP) inside its SKILL.md instructions. Before it hands back a simple BBC-headline lookup, the…

34. SkillFortify doesn't just scan skills, it proves the scan -- 96.95% F1, 0% false positives

    2026-02-27 — SkillFortify bills itself as the first formal-methods framework for agent skill supply chains: six components, each carrying a proof instead of a heuristic. Start with the DY-Skill attacker model ,…

35. Curated Skills Lift Success Rates 16.2 Points — Self-Generated Ones Cost You 1.3 Bridge: security × benchmarks

    2026-02-24 — An agentic skill, formalized here as a four-part contract S = (C, π, T, R), needs all four pieces to count: an applicability condition that decides when it fires, an executable policy, a…

36. Frontier Agents Cave to Poisoned Skill Files Up to 80% of the Time

    2026-02-23 — Researchers built SkillInject, a benchmark of 202 injection-task pairs that measures skill-based prompt injection — adversarial instructions planted inside agent skills , the third-party…

37. Automated SKILL.md rewrites push poisoned-skill attacks from 0% success to 80.7%

    2026-02-15 — SkillJect is an automated framework for manufacturing poisoned agent skills, and it works two channels at once instead of leaning on a single hand-crafted trick. The artifact channel buries the…

38. 26.1% of Community Skills Ship With a Vulnerability

    2026-02-12 — A skill loads in three strict stages, and that staging is the whole point. A SKILL.md file's YAML frontmatter — name and description, a few dozen tokens — sits in the system prompt from startup.…

39. 2 of 2 LLMs Fell for a Single Invisible HTML Comment

    2026-02-11 — Agent Skills — the Markdown files that tell an LLM agent which tools exist and how to use them — get rendered to HTML for human review. The model itself usually reads the raw Markdown instead,…

40. 84% of Malicious Agent-Skill Exploits Hide in the Docs, Not the Code

    2026-02-06 — Researchers ran 98,380 agent skills pulled from two community registries, skills.rest and skillsmp.com, through a four-stage detection funnel: static pattern matching against 14 rules tied to a…

41. 26.1% of Marketplace Agent Skills Carry a Vulnerability

    2026-01-15 — Researchers scraped 42,447 agent skills off two live marketplaces — skills.rest and skillsmp.com — and ran 31,132 unique packages through SkillScan, a three-stage detector chaining static/regex…

42. One Approval, Zero Further Checks

    2025-10-30 — Researchers turned Anthropic's own Agent Skills framework against itself. Agent Skills let a coding agent pull task-specific knowledge into its context at runtime from a SKILL.md markdown file…