Timofey Sanko and Yuan Tian study the approval choices packaged inside reusable agent skills. A skill is an instruction package centered on a SKILL.md file. Its directions can remove a checkpoint even when the package contains no attack.
Their study distinguishes instructions that loosen oversight from those that tighten it or merely document a flag. It analyzes 1.53 million distinct English skills, using 2,097 hand-reviewed instruction units to develop and evaluate a detector.
- About one in seventeen skills contains loosening. The detector estimates roughly 88,000 such skills. Among sampled loosening directives, 70.1% have no limiting condition such as an authorized unattended run.
- Execution and oversight language coincide. At equal amounts of oversight language, shell-running, package-installing and administrator-access skills have 1.7–1.8 times the odds of loosening oversight.
- Malware scanners miss the policy change. The strongest individual scanner catches 46% of relevant directives, with 27% of its flags correct. Their combined flags catch 51%, with 28% correct.
- The question matters. The same model prompted with the study’s oversight-labeling rules catches 61%, with 71% of its flags correct.
Review what a shared skill authorizes separately from whether it looks malicious. Explicitly limiting unattended behavior to its intended setting preserves a useful distinction between delegated work and a blanket permission change.
Caveat: This is an author-run English-text classification study with phrase-based retrieval and imperfect detection. It measures what instructions say, not how often assistants obey them or cause harm.