Malicious skill files compromised coding agents in controlled trials
Researchers disguised 471 shell commands inside 2,826 plausible skill files and recorded 5,629 completed runs, reporting exploitation rates of 95.5–96.1% for Gemini CLI and 71.6–74.0% for Qwen Code.
Why it matters: A readable Markdown skill becomes executable supply-chain material once an agent trusts its instructions or bundled scripts.