Static analysis catches malicious agent skills at 0.93 AUC — but detects shell-command host destruction 0% of the time
arXiv 2608.08468·medium signal
SkillsMetric maps where static analysis actually stops on 2,266 skills spanning 16 attack types, reaching an overall AUC of 0.93 and F1 of 73.4%±0.5%. The blind spots are the point: host destruction via shell commands evades detection entirely at 0%, and natural-language prompt injection is caught only 42% of the time. If you are linting third-party skills before install, this quantifies exactly which two attack classes your scanner will wave through, and argues for defense-in-depth rather than a single static gate.