Top agent skill security resources — November 2026

What it is

Adversa AI's first monthly roundup (November 2026) of 17 agent skill security papers and reports, mostly from October 2026. Its through-line is composition: skills that each pass vetting can still chain into violations. The summary names the PyCache trick, the sinkhole domain and the 612 compositions. This note adds the numbers behind the controls and the other findings.

Findings that change how you vet

Inspection-execution gap. Scanners read docs and visible source, but Python may run a bundled bytecode cache that behaves differently. Benign source plus a substituted cache reached 94-100% attack success across 100 skills and seven scanners. Execution-aware validation, which includes trusted reproduction of compiled artifacts, detected all 100 substitutions and reached 92.8% recall at a 10% false positive rate.

OpenAI render-deploy skill. The official skill said private Render services live under render-internal.com, which was not Render's domain. Codex wrote it into application code and deployment config as the default internal API address. After the domain was registered as a sinkhole, real services sent it live calls carrying tokens. The report gives no victim count. Render has removed the references, OpenAI has pulled the plugin from openai/plugins, and Render now controls the domain.

Composition.

• CoSA: adding skills (capped at 5% of each pool) raised the policy violation rate from 35.02% to 58.45% across five LLMs and three harnesses. A harness guard checking information flow and authorization before consequential actions cut violations from 65.28% to 6.67% on OpenClaw recruiting tasks. Benign task completion moved only from 66.67% to 65.00%.
• KnotScryer: 13.7% of the 612 insecure chains consist entirely of skills a single scanner labeled safe.
• CRIME: a benchmark of 4,000 public skills across eight cybersecurity behaviors, for testing vetting that only looks at single packages.

Cross-session artifacts. Files, configs and cached data written by one skill can steer another in a later session. Attack success was 46.7% to 77.4% across Codex CLI, Gemini CLI and Claude Code. SkillRelayGuard, which restores artifact provenance before execution, cut attack success from 69.5% to 10.9% and raised legitimate completion from 79.6% to 87.5%.

Oversight directives. About 1 in 17 of 1.53 million English skills (roughly 88,000) tells the agent to loosen oversight, for example proceeding without approval or using --no-verify. Of these, 70.1% apply unconditionally. Skills that run shell code, install packages or use sudo have 1.7-1.8 times the odds of carrying one. Open source scanners catch at most 46% at precision below 0.4.

Marketplace profile. Of 6,309 listings, half show shell execution capability, 31% network egress, 13% credential access, and seven in ten at least one elevated capability. Only 770 of 6,061 parseable listings declare anything in frontmatter, and 59% of those understate capability (ClawHub 88%, skillsmp 31%). Pre-approving tools in frontmatter removes prompts rather than restricting reach.

Supply chain. In a copy network of 2,193,119 GitHub skill adoptions, a few repositories source nearly all copies, and stars do not identify them. Auditing the top 100 source repositories prevents 14.9% of later high-risk adoptions, against 0.5% for the 100 most starred.

Injection and selection. Encoded instructions (Caesar and layered) reached up to 47.5% and 40.3% attack success across eight models. Jailbreaks in Markdown skills lifted mean success from 0.5% to 45% across seven open-weight models. Retrieval cuts naive injection success by 87-97%, but router-optimized attacks (CORSA, MetaCascade) overcome that. Results depended more on the model than on the obfuscation.

What to do

The page's intake checklist:

1. Map any path where one skill's output reaches another's input, and vet installed skills as a set.
2. Add a harness check on information flow and authorization before consequential actions.
3. Rebuild or reject bundled bytecode.
4. Ignore frontmatter declarations as evidence of capability.
5. Search skill text for encoded content, --no-verify and instructions to proceed without approval.
6. Extract every domain a skill references and confirm who owns it, official skills included. Check vendored copies for the patched render-deploy skill.
7. Replace copies with versioned references, diff retained copies against source, and pick audit targets by who gets copied from rather than by stars.
8. Attach provenance to artifacts persisted across sessions before another skill reads them.

Caveats

• Results vary by model, and decoding or obfuscation did not guarantee success. Test the models you run, since runtime scores alone do not rank them on lifecycle tasks (SkillLifeBench: 82.0% tie on runtime tasks, 96.7% versus 56.7% on lifecycle tasks).
• SCS (2,473 candidates, 627 confirmed) and MalSkills (620 flagged, 400 confirmed) use different methods and corpora, so their counts are not prevalence estimates. About one SCS candidate in four was confirmed, so triage needs a budget.
• The page is a digest. The figures come from the underlying papers, which it does not link here.