The runtime guard ships as an installable skill, and evolving it with MCTS beats pre-install vetting

arXiv·high signalXBlueskyLinkedInCopy link

Defense-as-Skill argues that pre-install vetting of agent skills is structurally insufficient because a malicious skill only triggers once a concrete user task and workspace state make the unsafe action look useful. Their guard, SkillSonar, runs as an installable and editable skill alongside untrusted skills, checking sensitive actions against the user's stated task boundary and routing each to allow, replan, or confirm without modifying the agent runtime. They built SCOPE-R, a task-conditioned dataset of 206 attack-confirmed malicious instances plus 43 benign tasks across 6 risk families and 21 sub-categories, and evolved the on-disk guard with Monte-Carlo Tree Search on rollout feedback, evaluated on both Claude Code and OpenClaw.