SkillsMetric: Mapping the Detection Boundary of Static Analysis for Malicious Agent Skills
These findings establish that static analysis alone is insufficient for skill security, motivating defense-in-depth architectures that combine fast static pre-screening with semantic review.