Beyond Maliciousness: Static and Runtime Attack-Surface Profiling of Agent Skills

Beyond Maliciousness. Static and Runtime Attack-Surface Profiling of Agent Skills. By Ratnesh Pandey and four others, from Metano Labs, Purdue University, and one other institution. Published on the thirteenth of October. No code repository is linked to it.

An agent skill is a Markdown document. A tool-using agent reads it as instructions, then acts on them with the privileges of whatever session loaded it. So installing a skill grants authority. The authors are careful about the word: it is the standing to direct the agent, not any new privilege. The size of that grant is what they set out to measure, and their claim is that it is large, mostly invisible at install time, and badly described by what skills declare about themselves. Triage at the marketplace boundary, they conclude, cannot rest on what a listing declares. It has to rest on what the bundle can actually do.

The measurement is a two-phase attack-surface profile. The static phase analyzes the whole bundle and checks the provenance of its dependencies. The runtime phase executes the skill in an instrumented sandbox, and the resulting traces are assessed separately by a model. They applied it to six thousand three hundred and nine listings from two marketplaces.

Half the corpus carries evidence of being able to execute shell commands. Thirty-five percent can read the filesystem. Thirty-one percent can write to it, and the same share can reach the network. Thirteen percent can access credentials. Seven listings in ten carry at least one elevated capability. That is the surface a user accepts on installing, and almost none of it is visible at that moment.

A permission model does exist, but it is close to inert. Authors can list, in the skill's own frontmatter, the tools it pre-approves. That removes confirmation prompts. It does not restrict what the skill can reach. Of the six thousand and sixty-one listings whose frontmatter parses, seven hundred and seventy declare anything at all. The vocabulary has no way to express credential or environment access, and nothing checks what it does express against the bundle.

Declaring is also not the same as declaring accurately. Fifty-nine percent of the listings that declare understate what their bundle can do. Between the two marketplaces the pattern splits. ClawHub declares roughly twice as often as skillsmp, yet its declarations under-declare eighty-eight percent of the time, against thirty-one percent for skillsmp.

The numbers cover two marketplaces, and they describe capability, not intent. Listings were chosen for execution without conditioning on any prior threat or risk signal, so the sample was not tilted toward suspicious skills. A skill that can reach credentials is not thereby shown to misuse them. That distinction is the point of the title: this is a measure of exposure, not a count of malicious skills.

The authors position capability-oriented attack-surface profiling as a necessary complement to maliciousness detection, not a replacement. A detector asks whether a skill means harm. This profile asks how much a skill could do if it did, and how much of that the user was told. On the evidence here, the answer to the second question is usually: less than the bundle can do, and often nothing at all.