The report
A malicious agent skill may describe an innocuous task in natural language while passing data to code that performs something else. The SCS study treats that combination as a program-analysis problem. Researchers collected 66,157 ClawHub skills and used textual and executable dependency relationships to find potential harmful paths. After additional dynamic and manual checks, they reported 627 malicious specimens in their sampled corpus. Checked sample.
The pipeline initially flagged 2,473 suspicious candidates. Those are not interchangeable with the smaller confirmed group, and neither number establishes how many users installed a skill or suffered an actual compromise. The study's classifications and follow-up evidence support a discussion of observed artifact behavior, not an extrapolation to ecosystem-wide victim prevalence. Candidate distinction.
This research answers a narrower question than CoSA's skill-composition attacks. SCS looks for malicious flows linked to individual skill instructions and code; CoSA asks whether an agent can assemble an unauthorized effect from locally admitted skills without adding new declared permissions. A scanner may correctly flag a malicious package and still miss a harmful arrangement of otherwise acceptable tools. CoSA comparison.
A useful deployment review therefore needs both provenance and runtime authorization. The first establishes what the skill contains and where it came from. The second checks whether the task's complete flow, including data sources and external sinks, was approved for that user. The study does not prove that a universal detector now exists for either boundary. Primary scanner paper.