The report
Researchers behind Scan Before You Install evaluated 1,587 publicly available agent skills and reported forty-one distinct vulnerabilities. They also tested controlled combinations in which one skill could read sensitive workflow material and another could transmit or authorize an action. A skill that appears innocuous when reviewed alone may be dangerous when an agent connects its output to another tool.
The paper's demonstrated compositions include paths joining repository history access with messaging tools, and watcher-style access with an OAuth-capable service. These are illustrative cross-tool flows rather than reports that those exact combinations stole tokens from real users. The study count concerns flagged vulnerabilities, not compromised organizations or the prevalence of a particular installed skill set.
The skill-composition investigation and original study identify the permitted data sources and destinations. Authorization needs to consider the entire set of tools available to one agent, including whether sensitive data from one call may enter a different tool's external action. Reviewing only the text of an individual skill misses this transitive capability.