'Do Not Mention This to the User': Detecting and Understanding Malicious Agent Skills
arXiv:2602.06547v3 Announce Type: replace-cross Abstract: LLM-based coding agents increasingly rely on third-party extensions called skills, which bundle natural language instructions and helper scrip