A third-party skill steered 81% of purchase decisions while passing every scanner.

SkillShift formalizes Skill Policy Integrity and shows a reusable skill acts as an externalized behavioral policy a supplier can bend without injecting any target command or breaking the declared output interface. In agentic commerce and software-dependency selection it reached attacker-favored selection rates of 81.33% and 63.33% at 100% utility preservation, and the frozen policies transferred across LLM backends with no re-optimization. The tested scanners did not detect them. Static review of a skill's text is not a control; the only defense the paper points to is behavioral auditing of what a skill makes the agent choose.