arXiv:2603.00195 · preprint · cs.CR
An agent skill is arbitrary code that runs with the agent's own authority, installed from a registry with no review gate. This paper gives the threat model a formal treatment, then builds static analysis, provenance verification and SBOM generation across 22 agent frameworks so a skill can be judged before it executes.
Our summary of the paper. The full abstract is on arXiv. Preprint, not peer reviewed.
@misc{bhardwaj2026skillfortify,
title = {Formal Analysis and Supply Chain Security for Agentic AI Skills},
author = {Varun Pratap Bhardwaj},
year = {2026},
eprint = {2603.00195},
archivePrefix= {arXiv},
primaryClass = {cs.CR},
url = {https://arxiv.org/abs/2603.00195}
}Keep reading
arXiv:2609.27871 · Aug 20, 2026
The instrument found 47 vacuous gates — checks satisfied by the absence of the thing they check — in shipped, reviewed code
arXiv:2608.12895 · Aug 13, 2026
Two instances of the same model failed together on 90% of missions where either failed — independence is not a safe assumption
arXiv:2608.08253 · Aug 8, 2026
Governed memory with scoped component evidence and disclosed negative results