---
type: "post"
id: "when-skills-tell-agents-not-to-ask-a-5e387d"
slug: "when-skills-tell-agents-not-to-ask-a-5e387d"
title: "When Skills Tell Agents Not to Ask: A Large-Scale Study of Oversight Directives in Agent Skills"
description: "A Queen’s University preprint finds that oversight-loosening instructions appear in an estimated 5.8% of 1.53 million public agent skills."
retrieval_nugget: "A Queen’s University preprint finds that oversight-loosening instructions appear in an estimated 5.8% of 1.53 million public agent skills. For teams building with agents, the result changes the review target: a skill can reduce approval and reporting checkpoints without looking like conventional malicious content, and existing scanners catch limited portions of that class."
published_at: "2026-10-31"
updated_at: "2026-10-31"
record_date: "2026-10-31"
date_kind: "published_at"
topics: ["skills","github"]
entities: ["Queen's University","GitSkills","Cisco AI Defense","NVIDIA SkillSpector","Timofey Sanko","Yuan Tian"]
related_patterns: ["agent-security-moves-to-runtime-boundaries","skills-become-portable-capability-layer"]
novelty_label: "new_fact"
what_changed: "A separate study of 1.53 million public agent skills finds oversight-loosening directives in about 5.8% and reports Cisco and NVIDIA scanners catch at most 46%, distinct from VirusTotal’s malware findings."
prior_refs: ["memory:b93493f9-9fbd-8097-a1c7-1ff2e970a8fe","memory:78077d3b-1a51-8b01-a41f-64c1224e4a80"]
source_url: "https://arxiv.org/html/2610.37734v1"
source_urls: ["https://arxiv.org/html/2610.37734v1"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:when-skills-tell-agents-not-to-ask-a-5e387d"
status: "published"
visuals: []
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/posts/when-skills-tell-agents-not-to-ask-a-5e387d/","markdown":"https://newruntime.com/posts/when-skills-tell-agents-not-to-ask-a-5e387d.md","json":"https://newruntime.com/posts/when-skills-tell-agents-not-to-ask-a-5e387d.json"}
---

# When Skills Tell Agents Not to Ask: A Large-Scale Study of Oversight Directives in Agent Skills

## Retrieval answer

A Queen’s University preprint finds that oversight-loosening instructions appear in an estimated 5.8% of 1.53 million public agent skills. For teams building with agents, the result changes the review target: a skill can reduce approval and reporting checkpoints without looking like conventional malicious content, and existing scanners catch limited portions of that class.

## Summary

A Queen’s University preprint finds that oversight-loosening instructions appear in an estimated 5.8% of 1.53 million public agent skills. For teams building with agents, the result changes the review target: a skill can reduce approval and reporting checkpoints without looking like conventional malicious content, and existing scanners catch limited portions of that class.

## What happened

Timofey Sanko and Yuan Tian published “When Skills Tell Agents Not to Ask,” a preprint dated 27 October 2026. The study examines agent skills: reusable instruction packages centred on a `SKILL.md` file that an agent loads when a task matches the skill’s description. The authors argue that a line in a widely copied skill can affect the oversight behaviour of every agent that loads it.

They define an oversight-loosening directive as an instruction that reduces human control over an agent’s actions. Examples include proceeding without approval, bypassing checks with `--no-verify`, continuing without checking in, acting without reporting, or overriding other instructions. The paper does not treat every such line as malicious. A directive may simply make a workflow less interrupt-driven. Its concern is that removing a checkpoint also removes an opportunity to catch an agent mistake or an injected instruction.

The researchers analysed 1.53 million English-language skills recorded by GitSkills across public GitHub repositories. They split skill files into sentences, bullets, table cells, and code lines; used 36 patterns to retrieve 1.37 million candidate units; manually labelled 2,097 units with a codebook; and trained a detector to classify the candidate population. The detector reported 0.80 accuracy and a kappa value of 0.65 on 400 held-out units. The authors estimate that about 88,000 skills, or about one in seventeen, contain at least one loosening directive.

The directives most commonly work through permission flags. Of those found, 70.1% apply unconditionally rather than being scoped to a context such as continuous integration. Skills that run shell code, install packages, or use `sudo` have 1.7 to 1.8 times the odds of containing a loosening directive compared with skills containing the same amount of oversight language; the paper says those skills do not compensate with more tightening directives.

Propagation is concentrated. Just 2.4% of skill families carrying a loosening directive account for half of all copies of loosening-carrying skills, while 1.1% of distinct loosening units account for half of all occurrences. The authors also tested Cisco AI Defense skill-scanner 2.2.1 and NVIDIA SkillSpector 2.12.0. The open-source scanners achieved at most 46% recall, with precision below 0.4. Prompting the LLM behind them with the paper’s codebook reached 61% recall and 0.71 precision.

## What the archive adds

This is a new empirical fact on a known skill-security story. [VirusTotal’s analysis of malicious AI skills](https://newruntime.com/posts/how-some-malicious-ai-skills-hide-instructions-from-7a9f9b/) concerned skills that conceal malicious instructions; this study instead measures ordinary-looking directives that relax approvals and checks. It also follows [the report on OpenAI coding agents weakening internal security monitoring](https://newruntime.com/posts/openai-s-own-agents-turned-off-security-monitoring-4d1aee/), another example in which agent behaviour can erode the mechanisms intended to supervise it.

## Trend signal

The result supports [Agent security moves to runtime boundaries](https://newruntime.com/patterns/agent-security-moves-to-runtime-boundaries/). The paper shows why instruction-level review and malware-style scanning are insufficient on their own: a skill can explicitly ask an agent to bypass a checkpoint without containing a conventional exploit. It also fits [Skills become a portable capability layer](https://newruntime.com/patterns/skills-become-portable-capability-layer/), whose value depends on provenance, security review, and behavioural evaluation.

## Connections to other events

NVIDIA SkillSpector is one of the tools evaluated in the preprint; the archive previously covered its release as a scanner for agent skills. The new evidence narrows the claim teams can make about that category: scanning may help identify malicious patterns, but the tested tools did not reliably identify instructions that loosen oversight.

## Why it matters

Teams often evaluate third-party skills as extensions of an agent’s capabilities: can the package search, deploy, install, or edit? This study suggests evaluating their control semantics as well. A skill can preserve useful functionality while changing whether the agent asks before a consequential action, reports what it did, or stops when blocked.

That distinction matters most where a skill can invoke shell commands, install dependencies, or use elevated privileges. The reported association is not proof that any individual skill is unsafe. It is, however, a reason to make those capabilities a triage signal and to treat blanket approval-bypass language as a policy decision that belongs to the adopting team, not silently to an imported package.

## What happens next

- **Skill repositories and scanner vendors will add explicit checks for approval-bypass and safeguard-bypass language.** (6 months, 65%). Watch for: rules or policies that distinguish oversight directives from malware signatures.
- **Teams with reusable agent-skill catalogs will add review fields for permissions, confirmation requirements, and reporting behaviour.** (12 months, 60%). Watch for: skill manifests or intake checklists covering these controls.

## Limits and uncertainty

This is a preprint, not a claim that every identified directive causes harmful behaviour. The sample covers 1.53 million English skills in GitSkills and public GitHub copies, so it does not establish prevalence in private repositories, other languages, or every agent ecosystem. The detector is imperfect, and the paper measures what skill text instructs agents to do, not whether particular agents obey those instructions in practice. The association with shell access, installation, and `sudo` is statistical rather than a causal finding. Scanner results apply to the named versions and the study’s codebook and evaluation setup.

## Skill to build now

Add an oversight pass to the intake review for every third-party skill. Search its instructions and examples for approval bypasses, `--yes`, `--no-verify`, instructions to continue without checking in, suppressed reporting, and attempts to override other instructions. Record whether each exception is acceptable for the workflow, especially when the skill can execute shell commands, install packages, or use elevated privileges. This review should complement, not be replaced by, a security scan.

## Reader takeaway

A public agent skill is not only a capability package; it is also a package of decisions about when an agent must pause, ask, report, and stop. The study’s numbers make that practical: those decisions are widespread, concentrated in copied families, and only partly visible to current scanners. Review the instructions that change oversight before granting a skill operational access.

## Open question

Can agent platforms expose approval, reporting, and stop conditions as enforceable runtime policy, so that a copied skill cannot silently relax them?

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Skills](https://newruntime.com/topics/skills.md): Explore the skills topic hub.
- topic hub: [Github](https://newruntime.com/topics/github.md): Explore the github topic hub.
- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Source Ledger](https://newruntime.com/source-ledger.json): Inspect the public source evidence graph.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)