Zero of 184 recent papers connect skill self-authoring with skill security

Insight · Mike Arbuzov · SkillFed Research · July 25, 2026

AI-assisted notes · reviewed by SkillFed

Five of the six research-direction pairs in the recent agent-skill literature are bridged by dual-topic papers. The pair formed by its two largest directions — agents authoring their own skills, and securing skill files — is empty, and three null models say that is not chance.

The agent-skill literature has two big centers of gravity. Skill evolution — agents that write, revise, and govern their own skill libraries — is the largest research direction in the SkillFed research corpus, with 83 of the 184 papers published since October 2025. Skill security — attacks on and defenses for skill files — is second, with 42. Together they are 68% of the recent literature.

They never touch.

The measurement

Every paper in the corpus carries a primary research-direction tag, and — where it genuinely works in two directions — a secondary one. 44 of the 184 recent papers carry two tags, which gives a direct census of which directions talk to each other:

Direction pair	Bridging papers
benchmarks + security	13
benchmarks + evolution	13
benchmarks + retrieval	7
evolution + retrieval	7
retrieval + security	4
evolution + security	0

Five of the six pairs are bridged. The empty one belongs to the two largest directions — the pair with by far the most opportunity to intersect. Under tag-based null models, a corpus with these direction sizes and this much dual-tagging should contain roughly 3 to 13 evolution×security papers: a conditional permutation model expects 3.2 (p = 0.0096), and a size-biased draw expects 13.2 — with zero empty cells in 200,000 draws. A third check never looks at the tags at all: on the embedding geometry, the cross-neighborhood edge count between the two directions runs at 0.32–0.38 of what matched nulls expect, the lowest of all six pairs in roughly four of five bootstrap resamples.

Two things make the zero sturdier than it looks:

Label noise can't fake it. A mislabeled tag can manufacture a spurious bridge; it cannot empty a cell. Of every number in that table, the zero is the one that gets more credible if you distrust the tagging.
It survives the dropped papers too. The sharpest objection is that bridging papers were seen and rejected at corpus admission. That was testable: scoring all 364 embedded papers — kept, adjacent, and rejected alike — by joint proximity to both directions' centroids, the best candidate anywhere scores +0.014. Nothing in the entire embedded region sits between the two directions. The void is a property of the literature we could see, not of our filing.

Why the gap exists — and why it's still a problem

Security research audits skills written by others: marketplace uploads, third-party SKILL.md files, registry supply chains. Evolution research builds skills the agent writes for itself. Nobody audits a self-authored skill at authoring time.

Meanwhile the evolution literature keeps reporting what are plainly safety findings, phrased as quality metrics: one in four model-generated skills backfires on the agent using it; self-authored skills crashed one model's accuracy from 78% to under 1%; a corrupted admission judge silently disabled skill retirement past a ~45% false-pass rate, and no amount of additional data recovered it.

One paper looks like a counterexample and is not: a six-stage skill-lifecycle threat taxonomy whose sixth stage is named "Evolution" (the cloned-listings study). Read closely, its "evolution" means publisher-side version updates — third-party update hygiene, not an agent authoring skills for itself.

And an inversion worth savoring: the first paper in the recent corpus — October 2025 — is an attack paper. For this artifact, the security literature predates the capability literature.

Three papers the gap implies, that nobody has written

1. Run any skill scanner against a skill compiled into weights. Four papers compile skills into model weights rather than text — skill-specific LoRA adapters, compiling skill documents into LoRA weights via hypernetwork, training skills into the model, difficulty-routed skill treatment. Every malicious-skill detector in the 42 security-tagged papers reads text, metadata, or code; none of the four weight-space papers is security-tagged, and the only security sentence among them runs the defensive direction — Moving skills to weight space reduces vulnerability to prompt injection attacks. Whether a poisoned SKILL.md's behavior survives compilation into an adapter — and what any existing detector scores on a weight-resident skill — is measured nowhere in the corpus.

2. Measure what an agent's own library growth does to its own retrieval. Skill shadowing, not context bloat, drives up to 68% of a 202-skill library's 21-point pass-rate drop — measured at experimenter-set library sizes over a fixed, curated pool. 83 evolution-tagged papers grow libraries monotonically and report end-task success; the shadowing decomposition has never been applied to a library the agent grew itself during the run being scored. Two author teams name the composition as future work (skill curation, skill retrieval). If the composition holds, a share of every reported self-evolution gain curve is a selection artifact of the library's own size.

3. Attack the inputs, let the agent write the skill. In every security paper in this corpus, the attacker authors the artifact — automated SKILL.md rewrites push poisoned-skill attack success from 0% to 80.7%, one disguised setup line hits 89.3%. Nothing studies an attacker who authors only the evidence — the environment, the traces, the judge's inputs — and lets the victim agent's own curation loop write and persist the harmful skill. The nearest occupant declares the adaptive case out of scope in its own words (our corruption is exogenous), and the field's dedicated skill-safety benchmark excludes longer-lived deployments where skills evolve, by construction.

Scope, stated plainly

Every claim here is about the SkillFed research corpus — 191 core papers at a 2026-07-21 cutoff, assembled from seed queries against arXiv. It is a large, curated query result, not a census of the literature. An absence in it is an absence in this corpus; each implied paper above is contingent on the seed vocabulary covering the phrasing the missing work would use.
The statistics run over the 184 papers published after 2025-10-01, when the modern skill-file artifact stabilized. One earlier corpus paper does bridge the pair — a 2025 verification study from the precursor era. The recent literature's cell is zero.
The direction tags are model-assigned, and their inter-rater reliability has not yet been formally measured. That caution cuts against bridge counts, not against the empty cell — which is exactly why this piece leads with the zero and not with anything subtler.

Stale and missing knowledge is not only a literature problem: auditing our own site with the skills we recommend found 19% of their criteria already out of date.

The research directory tags all 191 notes with these directions. If you work anywhere near the seam — securing what agents author for themselves — the evolution and security shelves are both open, and the bridge between them is unclaimed.

Zero of 184 recent papers connect skill self-authoring with skill security

The measurement

Why the gap exists — and why it's still a problem

Three papers the gap implies, that nobody has written

Scope, stated plainly

More from SkillFed Research