- Task success does not prove there were no extra actions.
- Inspect imports, scripts, and network effects together.
- Keep each detector claim tied to its evaluated setting.
Success is only one observation
A skill can produce the requested result while another part of the package performs an additional action. The revised One Skill, Two Masters preprint studies this pattern under the name PERSIST. Earlier versions were titled POISE; they are revisions of one work.
Follow the import chain
Review the entry instructions, referenced modules, helper calls, installation steps, and effects on files and networks. Record both the visible output and the complete set of actions. A task-correct answer cannot validate an unreviewed side effect.
Review language with code
SkillMutator specifically studies the gap between natural-language instructions and executable code. SchemaGuard examines structural pre-integration checks; SkillSpector describes whole-package pre-publication screening. Their reported detector results have different datasets, access levels, and claims. None is a certificate that an admitted skill is safe.
Approve bounded behavior
Compare each action against a user-authorized purpose, recipient, data class, and runtime permission. Treat scanner findings as review evidence and repeat checks when a skill, dependency, or host changes. This is editorial practice, not a tested guarantee from these papers.
Sources & scope
This guide combines editorial explanation and practical review suggestions. Linked sources support the underlying concepts; this site has not independently replicated their experiments.
S37