研究称约 6% 的 agent skill 文件绕过人类检查，现有扫描器漏检严重
扫了 153 万个 skill 文件，发现一堆让 agent 不经确认就干活的指令，扫描器还查不出来，自己写 skill 的都该看看怎么防。
一项研究分析了 GitHub 上 153 万个英文 SKILL.md 文件，发现约 8.8 万个（约 1/17）包含让 agent 跳过人类确认的指令，如 push without confirmation。其中 70.1% 的指令在所有场景下生效，而非仅限 CI 等特定环境。Cisco 和 NVIDIA 的两款开源扫描器即使调用 GPT-5.4，最多只检出 46%，精确率低于 0.4；同一 LLM 改问 oversight 问题后检出率升至 61%，精确率 0.71。研究建议将 skip 确认的指令限定在具体场景，并按 oversight 而非恶意软件来筛查 skill。
This paper finds that about 1 in 17 agent skills tells agents to skip human checks, and existing skill scanners miss most of them.
Agent skills are shared SKILL.md instruction files that agents load on demand. One line like "push without confirmation" or "keep going until done" removes a human checkpoint from every agent that loads it.
They analyzed 1.53 million English skills from public GitHub repos, then tested 2 open-source scanners from Cisco and NVIDIA that can call GPT-5.4.
Roughly 88,000 skills contain such a line, and 70.1% of these lines apply in every context, not only in cases like CI. The scanners caught at most 46% at under 0.4 precision, while the same LLM, asked about oversight instead of malice, caught 61% at 0.71 precision.
Limit every "don't ask" line in your skills to a context, such as CI only, and screen skills for oversight, not just malware.
