The Devil Wears Markdown: Detecting Malicious Intent Hidden in AI Agent Skill Instructions through Hybrid Static, Dynamic, and Agentic Analysis

Summary

This research paper evaluates three open-source scanners on 140 agent skills (80 malicious, 60 benign), including Cisco Skill Scanner with and without its LLM analyzer, finding default recall of 0.91 with 33 false positives and LLM-enabled recall of 0.85 with 40 false positives. It then proposes a framework combining static findings, safety-constrained sandbox evidence, and LLM reasoning, which detects 68 of 80 malicious skills with 0.93 precision and reduces false positives to five.

Topics

• AI agents

Related items

• InfoStealthyPoison: Manipulating LLM Agent Behavior through Procedural Poisoning of Third-Party SkillsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• MediumTop MCP security resources — November 2026Similar attack · Adversa AI Blog
• MediumAI broke the cybersecurity world. What’s next?Similar attack · The Verge (AI)
• InfoGem5-Shark: Smaug-based Heterogeneous Deep Learning Accelerator Security and Robustness Evaluation and Characterization FrameworkSimilar attack · OpenAlex (peer-reviewed AI security)
• InfoCVE-2026-123357: GROBID command execution through crafted PDF filename in Linux conversionSimilar attack · NVD/CVE Database