Separate marketplace curation effects from catalog composition

Determine whether differences in marketplace risk rates reflect publication-gating or curation practices rather than differences in the proportion of listings that contain any exposure, by conditioning comparisons on listings with nonzero exposure.

Background

The paper observes different risk shares between the two marketplaces but notes that the risk indicator is closely related to the amount of inert prose in each catalog. Consequently, marketplace-level risk comparisons conflate possible curation effects with differences in catalog composition.

The authors propose conditioning comparisons on listings that carry any exposure at all. This would test whether marketplace gating changes what is published or merely changes the mix of exposed and inert listings, but the paper does not perform that analysis.

References

The marketplace comparison in Section~\ref{sec:risk} cannot distinguish a curation effect from a difference in what each marketplace holds, because the risk indicator and the share of a catalog that is inert prose are close relatives on this corpus. Conditioning the comparison on listings that carry any exposure at all would separate the two, and would say whether gating changes what is published or only what is published alongside it.

— Beyond Maliciousness: Static and Runtime Attack-Surface Profiling of Agent Skills  (2610.19264 - Pandey et al., 13 Oct 2026) in Section Future Work, paragraph “Curation separated from catalog composition.”