A malicious agent skill can look safe when installed and turn dangerous only during a real task, so this paper argues that agents need runtime safety checks, not just pre-install scanning.

The problem is timing: a bad skill can wait until the agent has access to useful files, tools, credentials, or external services before pushing it beyond what the user actually asked for.

The paper proposes SkillSonar, a safety skill that checks sensitive actions while the agent is working and decides whether to allow them, narrow them, replan, or ask the user first.

On GLM-5, it cut attack success from 48.2% to 10.4% on familiar attack types and from 60.6% to 11.5% on unseen risk families.

A crucial result: simply installing the safety skill was much weaker.

The agent had to be explicitly told to consult it before acting.

overall, the paper says scan skills before installation, check their actions during execution, and still keep hard protections like permissions and sandboxing underneath.

– arxiv. org/abs/2609.01487

Title: "Defense-as-Skill: Evolving Runtime Guard Skill for Skill-Augmented Agents"