Why it matters
Trail of Bits bypassed multiple agent-skill scanners with compiled Python hidden beside benign source and with prompt-like prose that persuaded an LLM classifier to accept a malicious configuration. The experiments show recurring blind spots around unreferenced files, binaries, assets, and ambiguous installer behavior, and also explain why legitimate skills can contain patterns that look malicious.
My takeaway: Inspect every file recursively, reject unexpected compiled artifacts, build from reviewed source, pin and verify provenance, and install or run skills in an isolated environment. Treat scanner output as advisory evidence rather than a trust decision, especially when the scanner itself consumes attacker-controlled text.