Two agent-skill security scanners were both blind to `__pycache__`.

CVE-2026-84809 and CVE-2026-84811, both published September 2 at CVSS 7.1, hit Tencent's AI-Infra-Guard skill-scan and agentverus-scanner with the same flaw: each hardcodes __pycache__ directories and .pyc/.pyo/.pyd extensions into skip lists. An attacker ships benign Python source next to malicious compiled bytecode that executes on import, and agentverus-scanner returns a CERTIFIED verdict with high trust scores in both static and semantic modes while the payload runs. If your skill-install gate is either of these scanners, the gate does not see the file that runs. Delete compiled artifacts before scanning, or scan the archive rather than the extracted tree.