https://skillpoison.comEditorial guides on the security of reusable AI agent skills.https://skillpoison.com/guides/skill-poisoning.htmlhttps://skillpoison.com/guides/skill-poisoning.htmlA complete starting point: what gets poisoned, how a skill gains influence, and which boundaries determine the outcome.https://skillpoison.com/guides/skill-anatomy.htmlhttps://skillpoison.com/guides/skill-anatomy.htmlRead the package as a map of possible influence: metadata, instructions, references, scripts, assets, and dependencies.https://skillpoison.com/guides/instruction-boundaries.htmlhttps://skillpoison.com/guides/instruction-boundaries.htmlHow to reason about skill text that asks for more than the user’s task—and why enforcement must survive a bad interpretation.https://skillpoison.com/guides/metadata-selection.htmlhttps://skillpoison.com/guides/metadata-selection.htmlRisk can start before the main skill instructions load. Review descriptions, retrieval, and the planner’s choice of package.https://skillpoison.com/guides/references-assets.htmlhttps://skillpoison.com/guides/references-assets.htmlA skill’s supporting files can introduce instructions, destinations, or content that the entry file does not reveal.https://skillpoison.com/guides/scripts-dependencies.htmlhttps://skillpoison.com/guides/scripts-dependencies.htmlInspect the code path separately from the instruction path. A skill can introduce software behavior as well as natural-language guidance.https://skillpoison.com/guides/updates-provenance.htmlhttps://skillpoison.com/guides/updates-provenance.htmlHow to preserve the meaning of a review when package content, dependencies, or the execution environment changes.https://skillpoison.com/guides/model-artifact-backdoors.htmlhttps://skillpoison.com/guides/model-artifact-backdoors.htmlSome skills bundle learned artifacts. Reviewing their instructions and scripts may not reveal the behavior encoded inside a model.https://skillpoison.com/guides/skill-composition.htmlhttps://skillpoison.com/guides/skill-composition.htmlA workflow can create a risk that is difficult to see when each skill is reviewed in isolation.https://skillpoison.com/guides/threat-model.htmlhttps://skillpoison.com/guides/threat-model.htmlAn actionable map of influence, assets, actors, permissions, and recovery for one real skill workflow.https://skillpoison.com/guides/least-privilege.htmlhttps://skillpoison.com/guides/least-privilege.htmlDesign a permission profile that allows the task to work while limiting what a poisoned skill could reach.https://skillpoison.com/guides/reviewing-skills.htmlhttps://skillpoison.com/guides/reviewing-skills.htmlA practical sequence for deciding what to approve, what evidence to retain, and when to keep a skill out of a sensitive workflow.https://skillpoison.com/guides/defense-checklist.htmlhttps://skillpoison.com/guides/defense-checklist.htmlA concrete review baseline across package content, authority, execution, updates, and incident readiness.https://skillpoison.com/guides/detection-and-testing.htmlhttps://skillpoison.com/guides/detection-and-testing.htmlMeasure the complete path from loaded content to observable effect, while keeping evaluations isolated from production.https://skillpoison.com/guides/benchmark-reading.htmlhttps://skillpoison.com/guides/benchmark-reading.htmlA guide to interpreting attack success rates, datasets, defenses, and benchmark claims without turning one result into a universal conclusion.https://skillpoison.com/guides/lifecycle-evaluation.htmlhttps://skillpoison.com/guides/lifecycle-evaluation.htmlA review matrix from repository admission to evolution, with observable questions at every stage.https://skillpoison.com/guides/publishing-skills.htmlhttps://skillpoison.com/guides/publishing-skills.htmlPractical authoring choices that help downstream reviewers understand scope, permissions, dependencies, and changes.https://skillpoison.com/guides/incident-response.htmlhttps://skillpoison.com/guides/incident-response.htmlContain the package, preserve evidence, distinguish attempts from effects, and recover from a reviewed state.https://skillpoison.com/guides/experience-to-skill-poisoning.htmlhttps://skillpoison.com/guides/experience-to-skill-poisoning.htmlWhy a reusable rule needs its own review, even when the task that produced it appeared successful.https://skillpoison.com/guides/metadata-end-to-end.htmlhttps://skillpoison.com/guides/metadata-end-to-end.htmlReview the entire selection chain instead of treating skill metadata as harmless catalog text.https://skillpoison.com/guides/documentation-to-execution.htmlhttps://skillpoison.com/guides/documentation-to-execution.htmlA guide to reviewing examples and templates that a coding agent may copy into a real workflow.https://skillpoison.com/guides/scanner-benchmark-design.htmlhttps://skillpoison.com/guides/scanner-benchmark-design.htmlSource overlap, false alarms, and evaluation choices can change what a headline detection score means.https://skillpoison.com/guides/reading-research-revisions.htmlhttps://skillpoison.com/guides/reading-research-revisions.htmlA research librarian’s checklist for changing titles, revised taxonomies, and conference status.https://skillpoison.com/guides/marketplace-evidence.htmlhttps://skillpoison.com/guides/marketplace-evidence.htmlSeparate vulnerable packages, confirmed malicious behavior, and deliberately assembled test collections.https://skillpoison.com/guides/prerequisite-traps.htmlhttps://skillpoison.com/guides/prerequisite-traps.htmlReview installation requests and human handoffs as carefully as the actions an agent executes itself.https://skillpoison.com/guides/scanner-coverage-gaps.htmlhttps://skillpoison.com/guides/scanner-coverage-gaps.htmlLearn to read skipped files, parser failures, truncated content, and mismatched package inventories.https://skillpoison.com/guides/output-integrity.htmlhttps://skillpoison.com/guides/output-integrity.htmlAn agent can finish the visible task while steering recommendations, recipients, or decisions away from the user’s goal.https://skillpoison.com/guides/cross-skill-pretext.htmlhttps://skillpoison.com/guides/cross-skill-pretext.htmlFollow evidence, state, and authority across a skill chain when no single file explains the final action.https://skillpoison.com/guides/model-internal-detection.htmlhttps://skillpoison.com/guides/model-internal-detection.htmlRead detection research in terms of observed signals, benchmark conditions, and deployment limits.https://skillpoison.com/guides/scanner-evidence-levels.htmlhttps://skillpoison.com/guides/scanner-evidence-levels.htmlHow to write a review result that does not confuse a heuristic, a trace, an attempted action, and impact.https://skillpoison.com/guides/cross-session-skill-artifacts.htmlhttps://skillpoison.com/guides/cross-session-skill-artifacts.htmlTrace the authority of persistent files that connect multiple skills after chat history is cleared.https://skillpoison.com/guides/dual-purpose-skill-review.htmlhttps://skillpoison.com/guides/dual-purpose-skill-review.htmlInspect the entire package and its imports when a useful result could hide a separate side effect.