Yadnesh Salvi

Story · arXiv

Towards a Risk Assessment of Malicious Skill Files in Coding Agents (arXiv)

paper · Story page

The paper treats third-party skill files as the supply-chain risk they are: a 2,826-skill benchmark of malicious skills concealing shell commands, mapped to 11 MITRE ATT&CK tactics, with high reported exploitation rates for Gemini CLI and Qwen Code.

Appeared in

Subscribe

Get the brief in your inbox

Pick daily, weekly, or both. Nothing is gated either way: every issue is on the site and in the feeds.

  • Weekdays at 8:45am IST, one lead story and 6 to 9 items.
  • Sundays, an argued synthesis rather than a recap.
  • One click to leave, and quiet days say so in the subject line.
How often

Weekdays 8:45am IST + Sundays. Unsubscribe in one click.

You're asking for The Agentic Brief by email at the cadence you picked. You can unsubscribe in one click from any issue, and your address is never sold or shared.

Subscribe by RSS →