Evaluation & Ecosystem Measurement 

Dataset Construction 

We constructed the first large-scale labeled dataset of malicious agent skills by processing 98,380 skills from two major community registries. Our multi-stage pipeline filtered these down to 157 behaviorally-confirmed malicious skills. 

Sophistication: Deliberate Technique Layering  

Attacks are Deliberate, Not Accidental. This histogram shows the number of vulnerabilities per malicious skill. The distribution peaks at 4 vulnerabilities per skill, with 80.3% of skills containing 3 or more. This heavy layering confirms that these are intentional attacks combining multiple techniques, rather than simple developer errors. 

Kill Chain Coverage 

Full Kill Chain Execution. Malicious skills don't just stop at one stage. The median skill spans 3 out of 6 kill chain phases (e.g., Execution → Credential Access → Exfiltration). One recorded skill even covered all six phases, demonstrating a capability level comparable to mature malware families. 

Strategic Coordination 

Distinct Attacker Archetypes. This co-occurrence matrix reveals two negatively correlated attack strategies: 

• • 1. Data Thieves: Combine Credential Harvesting (E2) with External Transmission (E1) for supply chain exfiltration.

    2. Agent Hijackers: Focus on Instruction Override (P1) to subvert the AI's decision-making, separate from data theft.

Real-World Impact 

Impact Statement: 93.6% Removal Rate. Following our responsible disclosure of 157 confirmed malicious skills to platform maintainers, 147 skills (93.6%) were removed within 30 days, validating our findings and directly improving ecosystem security.