@misc{skillpoison_S01,
  title = {Agent Skills format specification},
  author = {Agent Skills maintainers},
  howpublished = {Documentation},
  url = {https://agentskills.io/specification},
  note = {Source catalog checked 2026-10-17}
}

@misc{skillpoison_S02,
  title = {Equipping agents for the real world with Agent Skills},
  author = {Anthropic Engineering},
  howpublished = {Documentation},
  url = {https://www.anthropic.com/engineering/equipping-agents-for-the-real-world-with-agent-skills},
  note = {Source catalog checked 2026-10-17}
}

@misc{skillpoison_S03,
  title = {Agent Skills in the Wild: An Empirical Study of Security Vulnerabilities at Scale},
  author = {Yi Liu et al.},
  howpublished = {Preprint},
  url = {https://arxiv.org/abs/2601.10338},
  note = {Source catalog checked 2026-10-17}
}

@misc{skillpoison_S04,
  title = {Skill-Inject: Measuring Agent Vulnerability to Skill File Attacks},
  author = {David Schmotz et al.},
  howpublished = {Preprint},
  url = {https://arxiv.org/abs/2602.20156},
  note = {Source catalog checked 2026-10-17}
}

@misc{skillpoison_S05,
  title = {SkillJect: Automating Stealthy Skill-Based Prompt Injection for Coding Agents with Trace-Driven Closed-Loop Refinement},
  author = {Xiaojun Jia et al.},
  howpublished = {Preprint},
  url = {https://arxiv.org/abs/2602.14211},
  note = {Source catalog checked 2026-10-17}
}

@misc{skillpoison_S06,
  title = {BadSkill: Backdoor Attacks on Agent Skills via Model-in-Skill Poisoning},
  author = {Guiyao Tie et al.},
  howpublished = {Preprint},
  url = {https://arxiv.org/abs/2604.09378},
  note = {Source catalog checked 2026-10-17}
}

@misc{skillpoison_S07,
  title = {SkillTrojan: Backdoor Attacks on Skill-Based Agent Systems},
  author = {Yunhao Feng et al.},
  howpublished = {Conference paper},
  url = {https://proceedings.mlr.press/v306/feng26c.html},
  note = {Source catalog checked 2026-10-17}
}

@misc{skillpoison_S08,
  title = {Agent Skill Security: Threat Models, Attacks, Defenses, and Evaluation},
  author = {Sanket Badhe and Priyanka Tiwari},
  howpublished = {Preprint},
  url = {https://arxiv.org/abs/2607.13987},
  note = {Source catalog checked 2026-10-17}
}

@misc{skillpoison_S09,
  title = {SkillSecurer: Detecting and Patching Prompt-Injection Vulnerabilities in AI Agent Skills},
  author = {Donato Mecca et al.},
  howpublished = {Preprint},
  url = {https://arxiv.org/abs/2609.14079},
  note = {Source catalog checked 2026-10-17}
}

@misc{skillpoison_S10,
  title = {Making Claude Code more secure and autonomous with sandboxing},
  author = {Anthropic Engineering},
  howpublished = {Documentation},
  url = {https://www.anthropic.com/engineering/claude-code-sandboxing},
  note = {Source catalog checked 2026-10-17}
}

@misc{skillpoison_S11,
  title = {Trustworthy agents in practice},
  author = {Anthropic Research},
  howpublished = {Documentation},
  url = {https://www.anthropic.com/research/trustworthy-agents},
  note = {Source catalog checked 2026-10-17}
}

@misc{skillpoison_S12,
  title = {“Do Not Mention This to the User”: Detecting and Understanding Malicious Agent Skills in the Wild},
  author = {Yi Liu et al.},
  howpublished = {Conference paper},
  url = {https://arxiv.org/abs/2602.06547},
  note = {Source catalog checked 2026-10-17}
}

@misc{skillpoison_S13,
  title = {Towards Secure Agent Skills: Architecture, Threat Taxonomy, and Security Analysis},
  author = {Zhiyuan Li et al.},
  howpublished = {Preprint},
  url = {https://arxiv.org/abs/2604.02837},
  note = {Source catalog checked 2026-10-17}
}

@misc{skillpoison_S14,
  title = {Supply-Chain Poisoning Attacks Against LLM Coding Agent Skill Ecosystems},
  author = {Yubin Qu et al.},
  howpublished = {Preprint},
  url = {https://arxiv.org/abs/2604.03081},
  note = {Source catalog checked 2026-10-17}
}

@misc{skillpoison_S15,
  title = {SkillJack: Persistent Skill Backdoors in Self-Evolving Agents},
  author = {Zonghao Ying et al.},
  howpublished = {Preprint},
  url = {https://arxiv.org/abs/2608.03509},
  note = {Source catalog checked 2026-10-17}
}

@misc{skillpoison_S16,
  title = {MaliciousSkillBench: A Comprehensive Benchmark for Malicious Agent Skill Detection},
  author = {Yue Wang et al.},
  howpublished = {Preprint},
  url = {https://arxiv.org/abs/2608.19901},
  note = {Source catalog checked 2026-10-17}
}

@misc{skillpoison_S17,
  title = {Exploring the Threat Landscape of Agent Skills — ToxicSkills},
  author = {Snyk Security Research},
  howpublished = {Industry research},
  url = {https://research.snyk.io/blog/agent-skills-threat-landscape/},
  note = {Source catalog checked 2026-10-17}
}

@misc{skillpoison_S18,
  title = {The Next AI Supply Chain Risk: Malicious Skills in Agentic AI},
  author = {Marta Janus and Jim Simpson · HiddenLayer},
  howpublished = {Industry research},
  url = {https://www.hiddenlayer.com/research/the-next-ai-supply-chain-risk-malicious-skills-in-agentic-ai},
  note = {Source catalog checked 2026-10-17}
}

@misc{skillpoison_S19,
  title = {Cisco Skill Scanner — scope, engines, and limitations},
  author = {Cisco AI Defense maintainers},
  howpublished = {Documentation},
  url = {https://github.com/cisco-ai-defense/skill-scanner},
  note = {Source catalog checked 2026-10-17}
}

@misc{skillpoison_S20,
  title = {SkillTrustBench — dataset card},
  author = {Tencent Zhuque Lab / CUHK Zhuque project},
  howpublished = {Dataset},
  url = {https://huggingface.co/datasets/cuhk-zhuque/SkillTrustBench},
  note = {Source catalog checked 2026-10-17}
}

@misc{skillpoison_S21,
  title = {MetaCascade: End-to-End Attacks on Agent Skills via Metadata-Only Poisoning},
  author = {Junhao Wen et al.},
  howpublished = {Preprint},
  url = {https://arxiv.org/abs/2610.14836},
  note = {Source catalog checked 2026-10-17}
}

@misc{skillpoison_S22,
  title = {SkillPoison: Progressive Skill Poisoning via Successful Experiences},
  author = {Lizhi Zhang et al.},
  howpublished = {Preprint},
  url = {https://arxiv.org/abs/2610.07645},
  note = {Source catalog checked 2026-10-17}
}

@misc{skillpoison_S23,
  title = {Adding skills support — client implementation guidance},
  author = {Agent Skills maintainers},
  howpublished = {Documentation},
  url = {https://github.com/agentskills/agentskills/blob/main/docs/client-implementation/adding-skills-support.mdx},
  note = {Source catalog checked 2026-10-17}
}

@misc{skillpoison_S24,
  title = {MalSkillBench: A Runtime-Verified Benchmark of Malicious Agent Skills},
  author = {Wenbo Guo et al.},
  howpublished = {Preprint},
  url = {https://arxiv.org/abs/2606.07131},
  note = {Source catalog checked 2026-10-17}
}

@misc{skillpoison_S25,
  title = {ClawHavoc: Analysis of Large-Scale Poisoning Campaign Targeting the OpenClaw Skill Market for AI Agents},
  author = {Antiy CERT},
  howpublished = {Industry research},
  url = {https://www.antiy.net/p/clawhavoc-analysis-of-large-scale-poisoning-campaign-targeting-the-openclaw-skill-market-for-ai-agents/},
  note = {Source catalog checked 2026-10-17}
}

@misc{skillpoison_S26,
  title = {How a Malicious Google Skill on ClawHub Tricks Users Into Installing Malware},
  author = {Liran Tal · Snyk},
  howpublished = {Industry research},
  url = {https://snyk.io/blog/clawhub-malicious-google-skill-openclaw-malware/},
  note = {Source catalog checked 2026-10-17}
}

@misc{skillpoison_S27,
  title = {Anatomy of a Deception: Uncovering the omnicogg Dropper in ClawHub},
  author = {David Cohen · JFrog Security Research},
  howpublished = {Industry research},
  url = {https://research.jfrog.com/post/omnicogg-malicious-skill/},
  note = {Source catalog checked 2026-10-17}
}

@misc{skillpoison_S28,
  title = {OpenClaw’s Skill Marketplace and the Emerging AI Supply Chain Threat},
  author = {Unit 42 · Palo Alto Networks},
  howpublished = {Industry research},
  url = {https://unit42.paloaltonetworks.com/openclaw-ai-supply-chain-risk/},
  note = {Source catalog checked 2026-10-17}
}

@misc{skillpoison_S29,
  title = {Malicious ClawHub Skills Target OpenClaw Users},
  author = {OpenSourceMalware research team},
  howpublished = {Industry research},
  url = {https://opensourcemalware.com/blog/malicious-clawhub-skills-target-openclaw-users},
  note = {Source catalog checked 2026-10-17}
}

@misc{skillpoison_S30,
  title = {From Automation to Infection: How OpenClaw AI Agent Skills Are Being Weaponized},
  author = {Bernardo Quintero · VirusTotal},
  howpublished = {Industry research},
  url = {https://blog.virustotal.com/2026/02/from-automation-to-infection-how.html},
  note = {Source catalog checked 2026-10-17}
}

@misc{skillpoison_S31,
  title = {OpenClaw Partners with VirusTotal for Skill Security},
  author = {Peter Steinberger, Jamieson O’Reilly, Bernardo Quintero},
  howpublished = {Documentation},
  url = {https://openclaw.ai/blog/virustotal-partnership},
  note = {Source catalog checked 2026-10-17}
}

@misc{skillpoison_S32,
  title = {Hiding in Plain Sight: Decoupling Pretext from Actuation for Skill Poisoning in LLM Agents},
  author = {Wenxin Wu et al.},
  howpublished = {Preprint},
  url = {https://arxiv.org/abs/2609.39352},
  note = {Source catalog checked 2026-10-17}
}

@misc{skillpoison_S33,
  title = {RouteGuard: Internal-Signal Detection of Skill Poisoning in LLM Agents},
  author = {Wenjie Xiao et al.},
  howpublished = {Preprint},
  url = {https://arxiv.org/abs/2604.22888},
  note = {Source catalog checked 2026-10-17}
}

@misc{skillpoison_S34,
  title = {SecureAI-Scan — OWASP GenAI Security Project solution listing},
  author = {OWASP GenAI Security Project solution directory},
  howpublished = {Documentation},
  url = {https://genai.owasp.org/solution/secureai-scan/},
  note = {Source catalog checked 2026-10-17}
}

@misc{skillpoison_S35,
  title = {SchemaGuard: Structure-Aware Detection of Tool-Poisoning and Skill-File Attacks in the LLM Agent Tool Supply Chain},
  author = {Salam Al-E’mari et al.},
  howpublished = {Journal article},
  url = {https://www.techscience.com/cmc/online/detail/28645},
  note = {Source catalog checked 2026-10-17}
}

@misc{skillpoison_S36,
  title = {Agent Context Poisoning: SKILL.md and the New AI Supply Chain Attack Surface},
  author = {Cloud Security Alliance AI Safety Initiative},
  howpublished = {Industry research},
  url = {https://labs.cloudsecurityalliance.org/research/csa-research-note-skill-md-agent-context-poisoning-20260506/},
  note = {Source catalog checked 2026-10-17}
}

@misc{skillpoison_S37,
  title = {One Skill, Two Masters: Serving Users and Attackers through Skill Injection},
  author = {Haochang Hao et al.},
  howpublished = {Preprint},
  url = {https://arxiv.org/abs/2606.07943},
  note = {Source catalog checked 2026-10-17}
}

@misc{skillpoison_S38,
  title = {Understanding and Mitigating Cross-Session Attacks via Persistent Artifacts in Agent Skill Composition},
  author = {Dianshu Liao et al.},
  howpublished = {Preprint},
  url = {https://arxiv.org/abs/2610.13227},
  note = {Source catalog checked 2026-10-17}
}

@misc{skillpoison_S39,
  title = {Agent Skills Enable a New Class of Realistic and Trivially Simple Prompt Injections},
  author = {David Schmotz, Sahar Abdelnabi, and Maksym Andriushchenko},
  howpublished = {Preprint},
  url = {https://arxiv.org/abs/2510.26328},
  note = {Source catalog checked 2026-10-17}
}

@misc{skillpoison_S40,
  title = {SkillMutator: Benchmarking and Defending Language-and-Code Cross-modal Attacks on LLM Agent Skills},
  author = {Youngduk Kim, Minkyoo Song, and Seungwon Shin},
  howpublished = {Preprint},
  url = {https://arxiv.org/abs/2606.14154},
  note = {Source catalog checked 2026-10-17}
}

@misc{skillpoison_S41,
  title = {SkillSpector: A Pre-Publication Security Control for Agent Skills},
  author = {SkillSpector research team},
  howpublished = {Conference paper},
  url = {https://openreview.net/pdf?id=rVAPXHmGHN},
  note = {Source catalog checked 2026-10-17}
}

@misc{skillpoison_S42,
  title = {ClawHub Malicious Skills Report — October 2026},
  author = {IronHeights research team},
  howpublished = {Industry research},
  url = {https://www.ironheights.dev/reports/clawhub-malicious-skills-2026-10/},
  note = {Source catalog checked 2026-10-17}
}