Evidence is specific. A benchmark result belongs to its tasks, model, permissions, and scoring. Preprints are labeled as preprints. Catalog notes summarize source material; they are not independent replication.
Journal article · published online 14 October 2026
A journal article proposes pre-integration review of MCP tool manifests and skill files, using structural analysis and light dynamic checks.
Question
Can package structure improve review before an agent admits a new tool or skill?
Why it matters
Tests a hybrid screening approach across constructed attack families and held-out categories.
Read with care
Published online in Computers, Materials & Continua. The publisher abstract reports F1 of 0.946 in a random split and 0.883 in held-out categories; neither is a production guarantee. Full PDF methods were not reviewed here.
Record checked
Publisher metadata and abstract; full PDF not reviewed · 17 October 2026
arXiv v3 · revised 13 October 2026; formerly POISE
The revised PERSIST study explores a skill that satisfies the visible user task while carrying an attacker-desired extra action in a separate imported module.
Question
Can task completion conceal a second action in a reusable skill package?
Why it matters
Links instruction review to code imports and side effects across controlled agent configurations.
Read with care
A controlled evaluation using SkillsBench and Skill-Inject settings; it does not establish field frequency. Earlier versions used the title POISE; this is the same arXiv work, not a second paper.
Record checked
Publisher full HTML revision reviewed · 17 October 2026
A vendor tracker links public skill reports to sources and explains its case-counting and scanner-fixture methods.
Question
How can a case tracker avoid double-counting overlapping reports?
Why it matters
States whether records are single skills, campaigns, or studies, and provides a dated coverage ledger.
Read with care
Its 22 entries mix cases, campaigns, and studies; statuses are not independently rechecked and tests use harmless reconstructions, not original malware. It is also a vendor page about its own scanner. Do not sum entries as unique victims or infections.
Record checked
Full report methodology and limitations reviewed · 17 October 2026
SkillRelayBench evaluates how attacker-controlled skills can coordinate through artifacts that survive a session reset.
Question
What changes when a downstream skill trusts an artifact written in an earlier session?
Why it matters
Models an upstream and downstream skill pair with persistent state, and evaluates a proposed SkillRelayGuard defense.
Read with care
The threat model assumes control of multiple third-party skills and surviving artifacts; 270 constructed cases across 30 scenarios and 10 domains are not live incidents. The reported defense gains apply to the evaluated systems.
Record checked
Publisher full HTML manuscript and threat model reviewed · 17 October 2026
Tests whether locally correct, verified experiences can induce an overgeneralized reusable behavior across three benchmarks and two skill-formation pipelines.
Question
Can task-correct experience still teach an unsafe reusable rule?
Why it matters
Separates task success during skill formation from later misapplication outside the original conditions.
Read with care
The reported 95.71% attack success is the PAWS / Trace2Skill / fifteen-experience condition, not a general rate. The corresponding DS1000 condition is 36.64%. Controlled tasks do not measure deployment prevalence. This independent site is not affiliated with the authors.
Record checked
Publisher HTML manuscript, methods and result tables reviewed · 17 October 2026
A project directory listing describes an offline static scanner that includes installed Agent Skills and labels findings proven, likely, or heuristic.
Question
How does one published scanner describe finding severity and evidence?
Why it matters
An example of reporting evidence tiers and traces instead of presenting every static finding as a confirmed event.
Read with care
The directory listing describes a tool; it is not an independent benchmark, product endorsement, or proof that the scanner detects every poisoned skill. Current implementation was not tested here.
Record checked
Publisher directory entry; tool not independently tested · 17 October 2026
An abstract-level account of a coordinated attack in which one skill changes context and another performs the resulting action.
Question
Can a downstream operation appear justified because an upstream skill changed the evidence it sees?
Why it matters
Separates the reason offered for an action from the action itself, across linked skills and persistent state.
Read with care
The indexed arXiv abstract was checked; full methods and results were not independently inspected. This is a controlled research proposal, not a documented field breach or a measured prevalence.
Record checked
Indexed arXiv abstract; full text not reviewed · 17 October 2026
A constructed benchmark studies attacks that cross skill instructions and bundled code, with install-time detector evaluations.
Question
Can a reviewer assess language and code together instead of screening them separately?
Why it matters
Describes thirteen mutation categories and scanner comparisons on the authors’ selected settings.
Read with care
The reported scanner detection ranges and improved distilled-model result refer to the constructed benchmark and a selected 76-sample subset. The publisher abstract was indexed; full manuscript could not be directly inspected in this review.
Record checked
Indexed publisher abstract; full text not reviewed · 17 October 2026
A workshop paper describes pre-publication review across metadata, instructions, permissions, dependencies, and code.
Question
What can a whole-package scanner make visible before publication?
Why it matters
Pairs deterministic checks with advisory semantic analysis and reports reviewable findings.
Read with care
Its 178-skill field exercise is unlabeled; the authors do not claim precision, recall, or ecosystem accuracy. The indexed PDF was available but the full manuscript was not directly reviewed here. Living repository counts can differ from the paper.
Record checked
Indexed publisher PDF abstract and official project repository; full PDF not reviewed · 17 October 2026
Studies pre-execution detection using response-conditioned attention and hidden-state alignment, evaluated on selected skill benchmarks.
Question
Can model-internal signals improve screening of malicious instructions inside an instruction-bearing skill?
Why it matters
Frames skill review as detecting instruction competition in material that legitimately instructs an agent.
Read with care
The authors state this is pre-execution detection, not live-agent prevention. Controlled channel probes, representative open-weight backbones, and reproduced baselines limit deployment claims.
Record checked
Publisher HTML manuscript and limitations reviewed · 17 October 2026
arXiv v1; official repository describes manuscript revision 450d7bc · 30 September 2026
Examines malicious logic carried inside documentation examples and configuration templates.
Question
Can apparently helpful examples influence executable output?
Why it matters
Studies the documentation-to-action boundary in coding-agent workflows.
Read with care
Evaluation starts after loading; discovery and installation are outside scope. Generated code and executed operations are separate outcomes. The repository describes a later manuscript than arXiv v1.
Record checked
Publisher abstract and official project README · 17 October 2026
Selected source dates, not a claim about priority or a complete history. Dates are initial publication dates unless a record explicitly says otherwise.