The Skill’s Hidden Contract

The public agent-skill ecosystem is vulnerable not only when a package contains a dangerous capability, but when that capability is kept outside the story shown to the user or outside the part of the platform being inspected. This chapter examines the study’s “shadow features,” documentation-level concealment, and platform-native attacks, then maps those failures to controls at publication, installation, runtime, and response. The practical aim is to decide which assurance matches which threat, rather than treating a signature, a scanner, or a sandbox as a universal safety certificate.

When the public story and runtime diverge

A shadow feature is an undocumented runtime capability that two researchers judged could not be inferred from a skill’s public description. The definition is deliberately relational. It does not ask whether the capability is technically impressive or whether the code looks suspicious in isolation. It asks whether the user-facing contract would have led a reasonable reviewer to expect the observed behavior.

That distinction is important for agent skills because their public story has several audiences. A registry uses a name and description to help people search. A human uses the same information to decide whether the capability belongs in their environment. The agent reads the persistent instructions to decide how to carry out a request. The runtime then supplies the files, credentials, network, and tools that make the decision consequential. A capability omitted from the public story can therefore evade a person at discovery, an agent at planning, or a platform at authorization.

The USENIX study found shadow features in 115 of 157 confirmed malicious skills, or 73.2%. The most common category was an undocumented network endpoint, followed by conditional triggers, obfuscated code segments, instructions hidden in comments or markup, and other behavior such as silent file changes or covert logging. These categories are not interchangeable probabilities; they are the study’s classification of how the documented and observed behaviors diverged. Their common feature is concealment across a boundary.

The boundary is often social before it is technical. A name can borrow the reputation of a familiar service. A description can emphasize a useful workflow while omitting a side effect. Instructions can use urgency or authority to make a questionable action seem like a prerequisite. A hidden directive can be visible in the file to a parser but effectively invisible to a casual reviewer. The attack succeeds when the package’s public contract is treated as a sufficient account of its behavior.

This is why code-level obfuscation is not the whole evasion story. Only 15 skills, or 9.5% of the confirmed set, used the code-obfuscation pattern tracked by the study. By contrast, concealment through documentation, conditional activation, and undocumented destinations appeared much more often. An encoded payload is a familiar security problem; a plain sentence that changes what an agent asks, reveals, or executes is harder to classify because its effect depends on interpretation.

The relationship with sophistication reinforces that point. Shadow features rise from 0% among basic skills to 86.1% among intermediate skills and 100% among advanced skills. Obfuscation also rises with the levels, but the broader pattern is not simply “more code tricks.” More sophisticated samples invest in keeping capabilities out of the user’s expected model.