Static analysis catches malicious agent skills at 0.93 AUC and misses shell-command host destruction 100% of the time.

SkillsMetric evaluated 2,266 skills across 16 attack types, hitting F1 of 73.4%±0.5% overall (arXiv 2608.08468). Host destruction via shell commands: 0% detection. Natural-language prompt injection: 42%. If you lint third-party skills before install, this tells you precisely which two classes your scanner waves through. Anthropic is defending at the other end, Claude Code 2.1.228 stops claude.ai-synced skills from shadowing local commands or MCP prompts, sanitizes their descriptions, and blocks their bodies from running ! commands or expanding @ file references locally (Claude Code Changelog). Enforcement at the point of execution, which is the right place. Note the breakage: if you sync skills from claude.ai that rely on ! or @, they stop working after upgrade.