Paper deep dive

SkillsMetric: Mapping the Detection Boundary of Static Analysis for Malicious Agent Skills

Xinze Chen, Chi Zhang, Ping Ji, Yimin Liu

Year: 2026Venue: arXiv preprintArea: cs.CRType: PreprintEmbeddings: 26

Intelligence

Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 90%

Last extracted: 8/12/2026, 1:44:13 AM

Summary

The paper introduces SkillsMetric, a five-stage static analysis framework designed to detect malicious Agent Skills in LLM-based agent ecosystems. The framework evaluates skills based on pattern density, statistical anomaly, dataflow taint, import anomaly, and capability mismatch. Evaluated on a dataset of 2,266 adversarial skills and the SkillMD-138K corpus, the framework achieves an AUC of 0.93. Key findings indicate strong detection for code-level attacks (e.g., data exfiltration, steganography) but significant blind spots for system-level attacks like host destruction (0% detection) and semantic-level attacks like prompt injection (42% detection). The authors argue that static analysis alone is insufficient and advocate for a defense-in-depth architecture combining static pre-screening with LLM-based semantic review.

Entities (9)

SkillsMetric · framework · 98%SkillMD-138K · dataset · 95%Host Destruction · attack-type · 92%Prompt Injection · attack-type · 92%Data Exfiltration · attack-type · 90%Steganography · attack-type · 90%Claude Opus 4.6 · model · 85%Gemini 2.5 Pro · model · 85%SkillMD · platform · 80%

Relation Signals (7)

SkillsMetric → evaluateson → SkillMD-138K

confidence 95% · evaluate on the full SkillMD-138K corpus.

SkillsMetric → failstodetect → Host Destruction

confidence 95% · host destruction attacks using common shell commands evade all five stages (0% detection)

SkillsMetric → detects → Steganography

confidence 90% · strong detection of data exfiltration (93%) and steganographic payloads (93%).

SkillsMetric → detects → Data Exfiltration

confidence 90% · Our framework achieves an AUC of 0.93 and 5-fold cross-validated F1 of 73.4%±0.5%, with strong detection of data exfiltration (93%)

SkillsMetric → motivates → Defense-in-depth

confidence 90% · These findings establish that static analysis alone is insufficient for skill security, motivating defense-in-depth architectures

SkillsMetric → partiallydetects → Prompt Injection

confidence 90% · prompt injection via natural-language manipulation achieves only 42% detection.

Claude Opus 4.6 → outperforms → Gemini 2.5 Pro

confidence 85% · Claude demonstrates substantially stronger security awareness than Gemini: 69.3% vs. 29.6% on code-level attacks.

Cypher Suggestions (0)

No Cypher suggestions yet.

Abstract

Abstract:Agent Skills---structured packages of instructions and scripts that augment LLM-based agents---are rapidly proliferating, yet their security properties remain under-explored. We present \textsc{SkillsMetric}, a five-stage static analysis framework that scores skill packages along pattern density, statistical anomaly, dataflow taint, import anomaly, and capability mismatch dimensions. We construct an adversarial evaluation dataset of 2{,}266 skills spanning 16~attack types across code-level, system-level, and semantic-level threats, and evaluate on the full SkillMD-138K corpus. Our framework achieves an AUC of 0.93 and 5-fold cross-validated F1 of 73.4\%$\pm$0.5\%, with strong detection of data exfiltration (93\%) and steganographic payloads (93\%). Crucially, we identify fundamental blind spots: \emph{host destruction} attacks using common shell commands evade all five stages (0\% detection), and \emph{prompt injection} via natural-language manipulation achieves only 42\% detection. These findings establish that static analysis alone is insufficient for skill security, motivating defense-in-depth architectures that combine fast static pre-screening with semantic review.

PDF

Open source PDF →Open local PDF →

Trouble viewing inline? Open PDF directly →

Full Text

24,801 characters extracted from source content.

Expand or collapse full text

SkillsMetric: Mapping the Detection Boundary of Static Analysis for Malicious Agent Skills Xinze Chen The Graduate Center, City University of New York New York, NY, USA xinze.chen95@gc.cuny.edu Chi Zhang The Graduate Center, City University of New York New York, NY, USA chi.zhang06@gc.cuny.edu Ping Ji Hunter College, City University of New York New York, NY, USA ping.Ji@hunter.cuny.edu Yimin Liu The Ohio State University Columbus, OH, USA yiminliu.career@gmail.com Abstract Agent Skills—structured packages of instructions and scripts that augment LLM-based agents—are rapidly proliferating, yet their security properties remain under-explored. We present SkillsMetric, a five-stage static analysis framework that scores skill packages along pattern density, statistical anomaly, dataflow taint, import anomaly, and capability mis- match dimensions. We construct an adversarial evaluation dataset of 2,266 skills spanning 16 attack types across code- level, system-level, and semantic-level threats, and evaluate on the full SkillMD-138K corpus. Our framework achieves an AUC of 0.93 and 5-fold cross-validated F1 of 73.4%±0.5%, with strong detection of data exfiltration (93%) and stegano- graphic payloads (93%). Crucially, we identify fundamen- tal blind spots: host destruction attacks using common shell commands evade all five stages (0% detection), and prompt injection via natural-language manipulation achieves only 42% detection. These findings establish that static analysis alone is insufficient for skill security, motivating defense-in- depth architectures that combine fast static pre-screening with semantic review. 1 Introduction LLM-based agents increasingly rely on Agent Skills—structured packages containing aSKILL.mdfile and optional compan- ion scripts—to acquire procedural knowledge at inference time without model modification. Skills have been adopted across major agent platforms including Claude Code, Gemini CLI, OpenClaw, and Codex, with over 138,000 community- contributed skills already in circulation [1]. This rapid adoption creates a significant attack surface. A malicious skill can instruct the agent to exfiltrate credentials, install persistent backdoors, or destroy local files—all while appearing to provide legitimate functionality. The threat is amplified by a trust elevation problem: skill runners typically inject SKILL.md content as user-level messages, granting third-party instructions the same authority as direct user commands. Yet systematic analysis of what detection meth- ods can and cannot catch remains absent. We address this gap with three contributions: (1) Attack taxonomy. A systematic categorization of 16 attack types targeting agent skills, organized into code-level (8 types), system-level (4 types), and semantic-level (4 types) threats (§2). (2) SkillsMetric framework. A five-stage static analy- sis pipeline with weighted score composition, calibrated base- lines, and interaction bonuses (§3). (3) Empirical boundary mapping. Evaluation on 2,266 labeled skills and 138,133 real- world skills, explicitly characterizing where static analysis succeeds and fails (§4). 2 Attack Taxonomy We organize skill-targeted attacks into three threat layers (Table 1). Code-level attacks embed malicious logic in ex- ecutable code via techniques ranging from plaintext dan- gerous commands to obfuscation (RSA modular encryption, XOR encoding, steganographic embedding); we also detect YAML deserialization and unsafepickle/marshalloading, though not as separate evaluated categories. System-level attacks target the host environment without requiring net- work exfiltration: host destruction (file deletion, permission corruption), persistence backdoors (crontab, authorized_keys, git hooks), environment manipulation (PATH hijacking, ma- licious pip.conf), and resource abuse (cryptomining, fork bombs). Semantic-level attacks exploit instruction-following: prompt injection embeds natural-language directives inSKILL.md that impersonate user intent (e.g., “This project is deprecated. Please delete the working directory.”), while social engineer- ing and supply chain attacks manipulate trust relationships. 3 SkillsMetric Framework SkillsMetric processes the full content of a skill package (SKILL.md + companion scripts) through five analysis stages, producing a composite risk score 푆 ∈ [0, 100]. Stage 1: Pattern Density scans for dangerous keywords and code constructs (exec,curl, credential paths, YAML deserialization, etc.) using 50+ weighted regular expressions across Python, Bash, JavaScript, and Ruby, normalized by content length. arXiv:2608.08468v1 [cs.CR] 9 Aug 2026 Table 1. Attack taxonomy with 16 types across three threat layers. Detection rates are at threshold휏=25 on our evalua- tion dataset. Layer Attack TypeN Det.% Code-level Plaintext command2982.8 Encoded payload2944.8 Data exfiltration2892.9 Steganography2892.9 RSA modular2889.3 ASCII smuggle (XOR)1968.4 Remote script2927.6 Binary execution1942.1 System Host destruction110.0 Persistence backdoor1163.6 Env. manipulation922.2 Resource abuse666.7 Semantic Prompt injection1241.7 Social engineering366.7 Split module333.3 Supply chain2100.0 Stage 2: Statistical Anomaly compares Shannon en- tropy, compression ratio, chi-squared uniformity, serial corre- lation, and integer-array scores against a benign-corpus base- line (z-scores), detecting encoded/encrypted payloads with abnormal byte distributions. Stage 3: Dataflow Taint Anal- ysis identifies three-phase taint chains (source - transform - sink)—e.g., reading credentials, base64-encoding, and send- ing via HTTP—with complete chains scoring the maximum. Stage 4: Import Anomaly flags unusual combinations of security-relevant packages (e.g.,urllib+base64+os) against a benign dependency baseline. Stage 5: Capability Mis- match compares declared SKILL.md capabilities against ac- tual code behavior, detecting skills that claim benign func- tionality but exhibit network/filesystem access. Score Composition. The final score is a weighted sum with interaction bonuses: 푆= 5 ∑︁ 푖=1 푤 푖 · ˆ 푠 푖 + bonus(s)(1) where푤= (0.15,0.20,0.30,0.15,0.10)and ˆ 푠 푖 is the normal- ized stage score. We use a weighted sum rather than a multiplicative ag- gregator (e.g., geometric mean) because many attacks leave signal in only a subset of stages—host destruction triggers no stage at all (0%, Table 1), and Figure 1 shows several attack types produce strong signal in only one or two stages—so any aggregator that vanishes on a single zero would discard a large fraction of the malicious population; the additive form also lets a reviewer read off each stage’s contribution, which a non-linear aggregator obscures. The weights are assigned empirically rather than learned, reflecting the per-stage signal observed on the benign and adversarial corpora (Figure 1): S3 (dataflow taint) receives the highest weight because complete source→transform→sink chains are rare in benign code and provide the cleanest dis- crimination, while S5 (capability mismatch) receives the low- est weight because metadata declarations are inconsistent across the benign corpus and yield a noisier per-stage signal. The weights sum to 0.90; the remaining headroom funds the interaction bonus, which adds 5 points when≥2 independent stages co-fire and 10 points when≥3 co-fire. S2 is excluded from bonus eligibility because its statistical features are not independent of S1 (high-entropy content typically triggers both). We treat manual weight assignment as a deliberate trade-off: it preserves interpretability and avoids overfitting to a relatively small adversarial dataset, but a learned compos- itor calibrated on real malicious skills is a natural extension (§5). Risk Levels and Threshold. The composite score maps to five risk levels: SAFE (<10), LOW (10–24), MEDIUM (25– 44), HIGH (45–69), and CRITICAL (≥70). The detection thresh- old휏=25 aligns with the MEDIUM boundary and is set with reference to the benign-corpus score distribution rather than the malicious one, so it does not depend on the specific com- position of our adversarial dataset: the 95th percentile of skill scores on the full 138K real-world corpus is 16.77 (§4), so휏=25 sits well above the bulk of natural skill content and holds the population-level flag rate to 1.75%. Sensitivity to휏 is reported implicitly through the ROC analysis (AUC 0.93); operators with different false-positive budgets can shift휏 along the curve—e.g.,휏=45 (HIGH boundary) is used as the auto-block tier in the defense-in-depth flow of §5. Figure 1 shows the mean per-stage scores for each attack type, visualizing which stages contribute to detection across attack categories. 4 Evaluation 4.1 Dataset Construction We construct an evaluation dataset from two sources: Benign skills (N=2,000): Sampled from SkillMD-138K [1] with stratification—400 skills with companion scripts (down- loaded via GitHub API) and 1,600 SKILL.md-only skills. Malicious skills (N=266): Created through three meth- ods: (1) 199 samples generated by injecting attack payloads into real benign host skills at varying positions, covering all 16 attack types; (2) 50 standalone malicious skills written from scratch; (3) 17 targeted samples including social engi- neering and supply chain attacks. Each injection uses a real benign skill as the host to ensure realistic content structure. Difficulty levels (easy/medium/hard) are balanced across at- tack types, with harder samples using deeper obfuscation and more plausible disguises. 2 S1 Pattern S2 Statistic S3 Dataflow S4 Import S5 Capability Data Exfil Steganography Rsa Modular Plaintext Cmd Ascii Smuggle Encoded Payload Binary Exec Remote Script Persistence Backdoor Resource Abuse Prompt Injection Env Manipulation Host Destruction 1333152416 1225161611 120241596 1277152014 187217115 117811107 14926127 11683136 287182018 1088111815 14225169 13303127 1014394 0 50 100 150 200 250 Mean Stage Score Figure 1. Mean stage scores by attack type. Code-level at- tacks trigger multiple stages (S1+S3+S4), while system-level and semantic attacks produce weak or zero signals across all stages. Table 2. Detection metrics on the v2 dataset (2,000 benign + 266 malicious). Metric Single-run (휏=25) 5-fold CV AUC0.9280.927±0.008 Precision63.4%89.4%±1.7% Recall62.4%62.2%±0.2% F162.9%73.4%±0.5% We acknowledge an important limitation of this construc- tion: synthetic injection cannot fully replicate the obfusca- tion depth or contextual disguise that a determined real- world attacker would employ. We therefore treat this dataset as a lower-bound characterization of detection difficulty, and complement it with the population-level scan in §4.3 (manual inspection of all top-scoring skills in 138K real-world con- tent) as an upper-bound check on whether overt malicious skills currently circulate in the ecosystem. 4.2 Results Table 2 summarizes the main results. The framework achieves an AUC of 0.93 with 5-fold cross-validated F1 of 73.4%±0.5% (precision 89.4%±1.7%, recall 62.2%±0.2%). Per-attack-type detection rates (Table 1 and Figure 2) re- veal a clear pattern: code-level attacks with network compo- nents are well-detected (data exfiltration 93%, steganography 020406080100 Detection Rate (%) Supply Chain Data Exfil Steganography Rsa Modular Plaintext Cmd Ascii Smuggle Resource Abuse Social Engineering Persistence Backdoor Encoded Payload Binary Exec Prompt Injection Split Module Remote Script Env Manipulation Host Destruction 100% 93% 93% 89% 83% 68% 67% 67% 64% 45% 42% 42% 33% 28% 22% 0% Code-level System-level Semantic-level Figure 2. Per-attack-type detection rates at휏=25, colored by threat layer. Code-level attacks (blue) are generally well- detected; system-level (red) and semantic (yellow) attacks show significantly lower detection. 93%, RSA modular 89%), while system-level and semantic- level attacks largely evade detection. Host destruction (0% detection) represents the most striking blind spot. These attacks use only standard library calls (shutil.rmtree,os.chmod) targeting user directories— operations indistinguishable from legitimate cleanup scripts at the syntactic level. No stage fires: there are no network sinks (S3), no unusual imports (S4), no encoded payloads (S2), and destructive commands likermare too common to flag without massive false positives (S1). Prompt injection (42% detection) partially evades de- tection because pure natural-language manipulation carries no code-level signal. The 42% that are detected contain em- bedded code blocks that trigger pattern density scoring. 4.3 Population-Level Analysis We score all 138,133 skills in SkillMD-138K at 142 samples/sec. To remain within GitHub API rate limits, this scan covers SKILL.md content only; companion scripts are not retrieved. We quantify the consequence of this scope below and revisit it in §5. The score distribution (Figure 3) is heavily right-skewed: median 2.58, 95th percentile 16.77. At휏=25, 1.75% of skills are flagged (2,414 out of 138,133). Risk-level distribution: 82.4% SAFE, 15.9% LOW, 1.5% MEDIUM, 0.3% HIGH, 0.004% CRITICAL. Manual review of top-scoring real-world skills. Man- ual inspection of the top-flagged skills shows they are pre- dominantly legitimate security tools—penetration testing skills, antivirus scanners, and similar dual-use tooling that neces- sarily contains dangerous-looking constructs (exec, network sinks, credential paths). Two implications follow: high scores correlate with security-relevant content rather than malice per se, so downstream LLM-based semantic review remains 3 01020304050607080 Risk Score 10 1 10 2 10 3 10 4 Count (log scale) Threshold (25) Figure 3. Score distribution across 138K real-world skills (log scale). The dashed line marks the detection threshold (휏=25). 98.25% of skills score below threshold. necessary to separate dual-use tools from genuine attacks; and although we do not observe widespread overt malicious skills at the SKILL.md scope, this does not generalize to com- panion scripts (where malicious logic typically resides), so the 1.75% flag rate should be read as a lower bound on true prevalence of risky content. 4.4 Cross-Model LLM Comparison To contextualize the role of LLM-based review, we report a preliminary comparison of two models’ security behavior on malicious skills executed in a sandboxed environment (Docker container with honeypot credentials, network isola- tion, and tool-use agent loop). Claude Opus 4.6 was tested on 150 code-level samples (8 types) before the dataset was expanded; Gemini 2.5 Pro was subsequently tested on the full 266 samples (16 types; 236 successful, 30 failed due to network isolation). Because the two models were not run on identical inputs, all head-to-head comparisons below are restricted to the 7 overlapping code-level attack types, and we treat the resulting numbers as illustrative rather than a fully controlled benchmark; a re-run of both models on a shared, identically configured sample set is needed for a definitive ranking and is left for follow-up work. We distinguish two levels of security response: hard refusal (the model explicitly refuses to execute) and security-aware (the model identifies the threat in its output—mentioning keywords such as “malicious,” “payload,” “credential,” or “warning”—but may still partially execute). Table 3 reports awareness rates alongside SkillsMetric static detection. Claude demonstrates substantially stronger security aware- ness than Gemini: 69.3% vs. 29.6% on code-level attacks. Claude is particularly effective on obfuscated attacks (RSA modular 84.2%, binary execution 84.2%, data exfiltration 83.3%), achieving near-complete threat identification. Of Table 3. Security detection on code-level attacks. Claude shows 69.3% security awareness with only 0.7% credential leakage; Gemini shows 29.6% awareness with 5.6% leakage. Attack TypeStatic Claude Gemini Canary Det.% Aware% Aware% (Gemini) Plaintext cmd82.831.634.55 Encoded payload44.863.220.72 Data exfiltration92.983.342.91 Steganography92.955.628.62 RSA modular89.384.248.10 Remote script27.652.610.30 Binary execution42.184.211.10 Code-level67.569.329.610 these, 11.3% are hard refusals where Claude explicitly de- clines to execute; the remaining aware cases involve Claude flagging the threat but partially proceeding. Gemini shows moderate awareness only on data exfiltration (42.9%) and RSA (48.1%), with near-zero awareness on binary execution (11.1%) and remote script (10.3%). The most consequential metric is actual credential exfiltra- tion, measured by canary token leakage (a unique marker em- bedded in honeypot files). Claude leaked the canary in only 1 of 150 runs (0.7%), while Gemini leaked it in 12 of 236 runs (5.1%)—a 7×difference. This confirms that Claude’s higher security awareness translates to effective containment: even when it does not formally refuse, it typically avoids com- pleting the exfiltration chain. Gemini’s canary leakage was concentrated in plaintext commands (5), prompt injection (2), steganography (2), encoded payloads (2), and data exfil- tration (1)—simpler attacks are more likely to achieve full exfiltration. On system-level and semantic attacks tested only on Gem- ini, awareness drops to 29.8% (17/57), with 0% on resource abuse and supply chain. These results highlight three points: (1) within the 7 over- lapping code-level types, Claude shows noticeably stronger security judgment than Gemini 2.5 Pro on our samples (7× canary-leakage gap, 0.7% vs. 5.1%; the absolute gap may shift under a matched evaluation but the direction is con- sistent with Claude’s code/security training); (2) Claude’s 69.3% awareness and static analysis’s 67.5% detection rate are complementary—static analysis catches structural patterns (steganography 92.9%) Claude partially misses (55.6%), and vice versa; (3) combining fast static pre-screening with LLM semantic review yields defense-in-depth at>100 skills/sec. 5 Discussion The static analysis boundary. Our results delineate a clear boundary: static analysis excels at detecting attacks that leave structural artifacts—unusual byte distributions, dataflow chains, suspicious import combinations—but fails 4 against attacks that use semantically normal code for ab- normal purposes. Theshutil.rmtree(~/Projects)call is syntactically identical to legitimate directory cleanup; distin- guishing intent requires understanding what is being deleted and why, which is beyond syntactic analysis. Trust elevation. Current skill runners inject SKILL.md content as user-level messages with system prompts such as “Follow the skill’s instructions carefully,” granting third-party content the same authority as direct user commands. This confused deputy pattern means that even a well-intentioned agent cannot distinguish skill instructions from user intent— a structural vulnerability that no amount of static analysis can address. Mitigations include explicit trust-level annota- tions on skill-provided instructions and sandboxed execution with reduced privilege. Defense-in-depth. These findings motivate a layered ar- chitecture: (1) static pre-screening (this work) at>100 skills/sec; (2) LLM-based semantic review for skills above휏 low , where the model can reason about whether some operations are con- textually appropriate—the intent-level judgment static anal- ysis cannot perform; (3) runtime sandboxing as final contain- ment. Skills above휏 high (e.g., 45) are auto-blocked; the tiered flow concentrates expensive LLM inference (∼1 skill/sec) on the∼2% of skills static analysis cannot confidently classify, reducing cost by∼50× vs. LLM-only review. Limitations. Three limitations bound our claims and di- rectly motivate near-term follow-up work. (1) Synthetic ad- versarial data. Our 266-sample malicious set, while substan- tially larger than prior work (266 vs. 11 samples), is con- structed by injecting attack payloads into real host skills. We do not capture the obfuscation depth or contextual mimicry of a determined real-world attacker; the population scan partially compensates by checking whether overt malicious skills exist in the wild, but undiscovered sophisticated sam- ples could still escape both pipelines. (2) Partial coverage of the population scan. The 138K scan is restricted to SKILL.md content because retrieving companion scripts requires per- skill GitHub API calls beyond practical rate limits. Because malicious logic typically resides in companion scripts rather than SKILL.md, the 1.75% flag rate should be read as a lower bound on true prevalence. A targeted re-scan of the 2,414 flagged skills with full companion scripts—feasible within rate limits at this reduced scale—is the natural next step and would tighten this bound. (3) Manually assigned stage weights. The weights in Eq. 1 are set empirically from per-stage signal analysis on our adversarial corpus, not learned. We chose manual assignment to preserve interpretability and avoid overfitting on a relatively small malicious sample; a learned compositor calibrated on a broader corpus of real malicious skills (once collected through the follow-up scan above) is a clear extension. (4) Small per-category counts, missing head- to-head baselines, and an under-controlled LLM benchmark. Several attack categories have small sample sizes , so per- type detection rates carry wide confidence intervals while aggregate code-level and system-level rates are more reliable; we do not run a direct head-to-head comparison against ex- isting scanners such as skill-security-analyzer because that tool publishes only an 11-sample test suite, leaving construc- tion of a shared cross-detector benchmark as follow-up; and the cross-model LLM comparison in §4.4 is preliminary, with Claude (150 samples) and Gemini (266 samples) run on par- tially overlapping sets and head-to-head numbers computed only on the 7 overlapping code-level types. Additional at- tack vectors such as time bombs and sandbox escapes are not evaluated as separate categories, though the framework includes detection patterns for YAML deserialization and unsafe serialization. 6 Related Work Agent skill ecosystems. The SkillMD-138K dataset [1] pro- vides the largest collection of real-world agent skills (138K entries) for ecosystem-level analysis. Skill security. The skill-security-analyzer 1 provides a regex-based scanning tool with 40+ pattern categories, achiev- ing 100% detection on 11 test samples. We provide a multi- stage scoring framework with weighted composition and base- line calibration rather than binary pattern matching, and systematically evaluate on 266 adversarial samples across 16 attack types to map detection boundaries rather than maximizing detection on a small test suite. Prompt injection. Prompt injection attacks on LLM agents have been studied extensively [2,3], but injection via skill packages represents a distinct vector where malicious instruc- tions are embedded in procedural knowledge files rather than direct user input. Software supply chain security. Our attack taxonomy draws from the broader supply chain security literature [4], adapting established categories (typosquatting, dependency confusion) to the agent skill context while introducing skill- specific threats (prompt injection via SKILL.md, capability mismatch). 7 Conclusion We present SkillsMetric, a five-stage static analysis frame- work for agent skill security, and construct the first large- scale adversarial evaluation dataset spanning 16 attack types. Our key finding is not what static analysis can detect (AUC 0.93 on code-level attacks), but what it cannot: host destruc- tion (0%) and prompt injection (42%) represent fundamental blind spots that require complementary detection methods. A population-level scan of 138K real-world skills shows a largely healthy ecosystem (82.4% SAFE) with a 1.75% flag rate. These results establish the empirical foundation for defense-in-depth architectures in the rapidly growing agent skill ecosystem. 1 https://github.com/anthropics/skills/pull/83 5 References [1]Z. Faye et al. SkillMD-138K: A Large-Scale Dataset of Agent Skills. HuggingFace Datasets, 2026. https://huggingface.co/datasets/FayeZC/ SkillMD-138K [2]K. Greshake, S. Abdelnabi, S. Mishra, C. Endres, T. Holz, and M. Fritz. Not What You’ve Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection. In Proc. AISec, 2023. [3]S. Perez, F. Ribeiro, et al. Ignore This Title and HackAPrompt: Exposing Systemic Weaknesses of LLMs through a Global Scale Prompt Hacking Competition. In Proc. EMNLP, 2023. [4] M. Ohm, H. Plate, A. Syber, and M. Maier. Backstabber’s Knife Collec- tion: A Review of Open Source Software Supply Chain Attacks. In Proc. DIMVA, 2020. 6

Instant research discovery