Skill security 42 papers

Researchers scraped 42,447 agent skills off two live marketplaces — skills.rest and skillsmp.com — and ran 31,132 unique packages through SkillScan, a three-stage detector chaining static/regex analysis, an LLM-Guard input screen, and a Claude 3.5 Sonnet classifier tuned to flag security patterns. The corpus got split three ways to keep the taxonomy honest: one slice built the pattern taxonomy, one calibrated detection rules, one validated it. Against 200 skills hand-labeled by two researchers with penetration-testing backgrounds (inter-annotator agreement κ=0.83), SkillScan hit 86.7% precision and 82.5% recall.

Researchers turned Anthropic's own Agent Skills framework against itself. Agent Skills let a coding agent pull task-specific knowledge into its context at runtime from a SKILL.md markdown file plus any scripts it references — no code-review step, no separate trust channel from the rest of the model's instructions. The authors took Anthropic's own published PowerPoint-editing skill, inserted an instruction calling a disguised "backup" script, and ran the attack two ways: inside Claude Code, and inside Claude's web interface once its skill-upload feature was live there too.