The report
Agent skills introduce multiple trust decisions before a tool produces an effect. In MetaCascade, researchers manipulated skill metadata, then measured whether agent discovery and ranking would select their targeted malicious skill. Across two evaluated agents and four datasets, final selection averaged 74.24% without defenses and 63.33% across defense tests. These are selection outcomes, not verified code execution or data theft.
A separate study, Ciphered Skill Injection, embedded obfuscated instructions in skill files. Its authors report up to 47.5% and 40.3% attack success for Caesar-style and layered variants under a controlled shortened-skill setting. The ability to decode text was measured separately from acting on it, and published abstract-level figures do not establish a circulating malicious package campaign.
The evidence points to distinct controls: authenticated origin and integrity for search metadata, and independent authorization of every action once a skill is selected. Static text scanning alone cannot establish either property. A third official-skill domain disclosure shows why even nonmalicious skill instructions deserve dependency verification before generated code is deployed.
Selection and execution need separate tests
MetaCascade's denominator is agent selection after poisoned discovery metadata. Ciphered Skill Injection studies whether decoded text changes behavior after a skill is read. A defense could pass one evaluation and fail the other: signing the script bytes might not establish who controls a retrieval description, while scanning descriptions for obvious malicious wording cannot ensure decoded material will remain data. The two reported success ranges should not be pooled into a single "skill attack rate" because their tasks and outcomes are different.
The Render deployment incident adds a third condition: a skill can be authentic and still contain an unsafe default. That case tests dependency correctness rather than adversarial metadata control or instruction decoding. Keeping all three mechanisms distinct makes subsequent remediation measurable.