Automated Marketplace-Scale Vetting of Agent Skills

Develop automated vetting pipelines for Agent Skills that combine static analysis of bundled scripts, semantic analysis of natural language instructions, dynamic analysis in sandboxed environments, and provenance verification of dependencies, while maintaining low false positive rates suitable for marketplace-scale review.

Background

The paper argues that manual marketplace review will not scale with community contribution volumes. Existing scanners provide heuristic checks but do not robustly analyze natural language instructions or novel attack techniques.

A comprehensive automated vetting pipeline must integrate multiple analyses and still avoid blocking legitimate Skills due to high false positive rates.

References

Developing automated vetting pipelines that combine static analysis of bundled scripts, semantic analysis of natural language instructions, dynamic analysis of Skill behavior in sandboxed environments, and provenance verification of declared dependencies---while maintaining low false positive rates to avoid blocking legitimate Skills---is an open engineering and research challenge.

— Towards Secure Agent Skills: Architecture, Threat Taxonomy, and Security Analysis  (2604.02837 - Li et al., 3 Apr 2026) in Section 7.2, Open Challenges (C6: Automated Skill Vetting)

Reliable malicious Agent Skill detection therefore remains open, and progress requires diverse malicious and benign coverage together with source-aware, two-sided evaluation.

— MaliciousSkillBench: A Comprehensive Benchmark for Malicious Agent Skill Detection  (2608.19901 - Wang et al., 20 Aug 2026) in Section 7, Conclusion (Section \ref{sec:conclusion})

Driving each listing through several sessions, or through inputs chosen to reach paths a single task does not, would tighten that bound and would test whether the disagreement between the phases in Section~\ref{sec:static-vs-dynamic} narrows or holds.

— Beyond Maliciousness: Static and Runtime Attack-Surface Profiling of Agent Skills  (2610.19264 - Pandey et al., 13 Oct 2026) in Section Future Work, paragraph “Coverage of what a session exercises.”

Whether a static detector for configuration-writing scripts identifies them reliably, and what a corpus-wide sweep with one would return, is untested here.

— Beyond Maliciousness: Static and Runtime Attack-Surface Profiling of Agent Skills  (2610.19264 - Pandey et al., 13 Oct 2026) in Section Future Work, paragraph “Code nothing invokes.”