The report
The October 9 SkillRelayBench paper tests whether an attack can survive the end of an agent conversation through files and other artifacts reused by a later skill. Its 270-case benchmark spans 30 scenarios and reports attack success ranging from 46.7% to 77.4% across the tested configurations. The result concerns controlled workflows, not a measured rate of compromised skill marketplaces.
The attacker controls multiple skill packages before deployment, but cannot rewrite the user tasks, trusted project policy or model, or change files between sessions. Seven configurations run the 270 cases, yielding 1,890 scheduled runs without manual tool-call approval. Those assumptions matter: the experiment does not measure how likely a user is to install both controlled packages or authorize their actions in practice.
The paper distinguishes a harmful consequence from the intended cross-session route. Attack Success Rate counts the specified consequence however it occurs, while Attack Chain Success Rate also requires the planned artifact handoff. Legitimate task completion can coexist with either failure.
SkillRelayGuard adds provenance context when artifacts are read and advisory review before execution. In a separate three-setting comparison, the authors report attack success falling from 69.5% to 10.9%. That is not the same population as the seven-configuration benchmark, and the agent retains the final decision. The full dossier explains the distinction between improved review and independently enforced authorization.