The BaseResearcharXiv

The Devil Wears Markdown: Detecting Malicious Intent Hidden in AI Agent Skill Instructions through Hybrid Static, Dynamic, and Agentic Analysis

According to the abstract, Thanh M. Truong-Le and colleagues test three open-source scanners on 140 agent skills and then propose a framework combining static, sandbox and LLM analysis, raising F1 from 0.70 to 0.85 when dynamic evidence is added.

Open the source ↗

Why it matters

The same thing, for different readers.

For researchers

Thanh M. Truong-Le and co-authors show detection of malicious agent skills is weak with static scanning alone and improves with combined analysis.

How the finding was reached

In our words, from the source. Weigh the finding by how it was made.

What was done
Three open-source scanners evaluated on a held-out set of 140 skills (80 malicious, 60 benign), then a hybrid framework compared in an evidence-source ablation.
What it found
The default Cisco configuration reached recall 0.91 with 33 false positives among 60 benign skills; with an LLM analyzer (Qwen3:8B) recall 0.85 with 40 false positives. Adding dynamic evidence raised F1 from 0.70 to 0.85.
What it does not show
Small test set; the excerpt is cut off, so further limits are not seen.
Status
A preprint: not yet peer reviewed

The record

Questions
How is AI used in attacks, defence and war? · Are AI companies putting stronger safeguards into practice?
People
Thanh M. Truong-Le (Wrote it)
What we read
We have read only the description the publisher gives. No quotations until someone reads the source itself.
Found by
The Radar, run of November 8, 2026, via arxiv-ai-safety-query (tier 1: the source’s own channel or an official record)
Cite this
arXiv, “The Devil Wears Markdown: Detecting Malicious Intent Hidden in AI Agent Skill Instructions through Hybrid Static, Dynamic, and Agentic Analysis”, November 7, 2026. Entry in the Ctrl AI Base, https://ctrlai.com/base/arxiv-2026-11-07-devil-wears-markdown-agent-skills
Our notesLight lane: written from the triage excerpt only. Same authors as the Agents of Chaos survey in group D3; the story id is a guess to confirm.