Pith. sign in

REVIEW 2 major objections 1 cited by

Trust Me, Import This: Dependency Steering Attacks via Malicious Agent Skills

T0 review · 2 major / 0 minor · reviewed 2026-05-12 · grok-4.3

Challenge this review Download PDF Read on arXiv ↗

Pith's one-line read Malicious Skills can steer LLM coding agents toward generating specific attacker-controlled package names.

desk verdict The paper shows how to optimize small edits in agent Skills to actively steer coding LLMs toward attacker-chosen package imports, but the edits' reliability outside the test set is the open question. read the letter →

arxiv 2605.09594 v1 submitted 2026-05-10 cs.CR

Yiyong Liu , Chia-Yi Hsu , Chun-Ying Huang , Michael Backes , Rui Wen , Chia-Mu Yu This is my paper
classification cs.CR
keywords dependencysteeringLLMcodingagentssoftwaresupplychainattacksmaliciousskillspackagehallucinationagentsecurityimport
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper demonstrates that attackers can create malicious Skills for LLM coding agents that subtly bias the agent to import specific packages chosen by the attacker. This is done by making small semantic changes to the Skill that keep its original purpose looking legitimate. The resulting Dependency Steering attack works across different models and coding tasks, achieves high rates of targeted hallucinations, and is hard for scanners to catch. If correct, this means that the persistent instructions agents use form a new and hard-to-secure part of the software supply chain.

What carries the argument

Skill-level optimization for localized semantic edits that preserve benign appearance while increasing the generation rate of a specific target package name.

What would settle it

Compare the frequency of generating the target package when using the optimized malicious Skill versus the original Skill on the same set of coding tasks and models; a significant increase only in the malicious case would support the claim.

Watch

Extended reading notes

Core claim

Dependency Steering is an attack in which a malicious Skill biases a coding agent toward an attacker-controlled package during benign coding tasks. The attack is constructed using a Skill-level optimization method that searches for localized semantic edits preserving the apparent purpose of the original Skill while increasing targeted package generation. Across multiple coding-oriented LLMs and programming benchmarks, it achieves high targeted hallucination rates, transfers across models and task domains, and remains difficult for evaluated Skill scanners and LLM-based auditors to detect.

Load-bearing premise

Localized semantic edits to a Skill can reliably increase the generation of a specific attacker-chosen package name while keeping the Skill's apparent benign purpose intact across diverse coding tasks and models.

Editorial extensions

If this is right

  • Attackers can influence software supply chain decisions made by coding agents without direct access to models or user inputs.
  • Persistent Skills represent an underexplored vector for inducing targeted hallucinations in LLM agents.
  • Standard detection methods for malicious Skills fail to identify these optimized steering attacks.
  • Transferability across models allows a single attack design to affect multiple agent systems.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Agent platforms may need to implement independent verification of suggested packages separate from Skill instructions.
  • Similar steering techniques could be applied to influence other agent actions beyond package imports.
  • Long-term, this suggests a need for formal verification or sandboxing of agent instruction artifacts.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

2 major / 0 minor

Summary. The manuscript introduces Dependency Steering, an attack in which a malicious Skill (persistent agent instruction artifact) is optimized via localized semantic edits to bias LLM coding agents toward hallucinating a specific attacker-controlled package name during otherwise benign coding tasks. The attack requires no model weight changes, training data poisoning, or user prompt modification. A Skill-level search procedure is used to discover edits that preserve the Skill's apparent purpose. Across multiple coding LLMs and programming benchmarks the paper reports high targeted hallucination rates, transfer to unseen models and task domains, and evasion of both static Skill scanners and LLM-based auditors, framing persistent Skills as a new software supply chain attack surface.

Significance. If the empirical claims hold, the work identifies a previously underexplored persistent attack vector at the reusable-Skill layer of LLM agents, extending supply-chain threats beyond registry poisoning or prompt injection. The optimization technique for achieving targeted behavioral steering while maintaining apparent benignity is a concrete technical contribution that could inform both future attacks and the design of Skill-vetting tools. The paper earns credit for grounding the threat model in realistic agent workflows rather than contrived one-shot prompts.

major comments (2)
  1. Evaluation section: The abstract and results claim high targeted hallucination rates, cross-model transfer, and undetectability, yet provide no quantitative details on trial counts, exact success metric definitions (e.g., package-name string match criteria), statistical significance tests, or control baselines (original Skill hallucination rates). This absence prevents verification of the central empirical claims and transfer results.
  2. Method and Results sections: The Skill-level optimization for localized semantic edits is load-bearing for the realism claim, but no ablation is presented demonstrating that the discovered edits preserve the original Skill's stated purpose and output behavior on tasks or models outside the fixed optimization benchmark. The skeptic concern about generalization therefore remains unaddressed by the reported evaluation.

Simulated Author's Rebuttal

2 responses · 0 unresolved

We thank the referee for the constructive feedback and for recognizing the potential significance of Dependency Steering as a supply-chain attack vector. We agree that the evaluation requires additional quantitative rigor and explicit ablations to fully substantiate the claims. We will revise the manuscript to address both major comments.

read point-by-point responses

  1. Referee: Evaluation section: The abstract and results claim high targeted hallucination rates, cross-model transfer, and undetectability, yet provide no quantitative details on trial counts, exact success metric definitions (e.g., package-name string match criteria), statistical significance tests, or control baselines (original Skill hallucination rates). This absence prevents verification of the central empirical claims and transfer results.

    Authors: We agree that the current presentation of results lacks sufficient detail for independent verification. In the revised manuscript we will expand the Evaluation section to report: the precise number of trials conducted for each model-benchmark combination, the exact success criterion (exact string match on the attacker-controlled package name within generated import statements), statistical significance testing (binomial tests against the unmodified Skill baseline with reported p-values), and explicit control baselines showing hallucination rates for the original Skills. These additions will be placed in a new subsection on experimental protocol and will include tables summarizing all metrics. revision: yes

  2. Referee: Method and Results sections: The Skill-level optimization for localized semantic edits is load-bearing for the realism claim, but no ablation is presented demonstrating that the discovered edits preserve the original Skill's stated purpose and output behavior on tasks or models outside the fixed optimization benchmark. The skeptic concern about generalization therefore remains unaddressed by the reported evaluation.

    Authors: We acknowledge that an explicit ablation quantifying preservation of the original Skill purpose is missing. Although the optimization objective includes a semantic-similarity term intended to keep edits localized and benign, we did not evaluate task-completion fidelity or purpose preservation on held-out tasks and models. In the revision we will add a dedicated ablation subsection that measures (i) task success rates and (ii) human-rated purpose fidelity for both original and optimized Skills across additional benchmarks and models not used during optimization. This will directly test the generalization concern. revision: yes

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: empirical attack demonstration with no derivation chain

full rationale

The paper introduces Dependency Steering as an empirical attack on LLM coding agents via malicious Skills, using a search-based optimization to find localized semantic edits. No equations, first-principles derivations, or predictions are claimed that could reduce to fitted parameters, self-definitions, or self-citation chains. All results stem from experimental evaluations on benchmarks and models, with the core method (Skill-level optimization for edits preserving apparent purpose) being a constructive procedure rather than a tautological reduction. The work is self-contained as an attack demonstration without load-bearing circular steps.

Assumptions & free parameters 0 free parameters · 0 assumptions · 0 invented entities

Based solely on the abstract, no explicit free parameters, axioms, or invented entities are stated; the attack relies on standard assumptions about LLM instruction-following and package-name generation behavior.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Trust Me, Import This: Dependency Steering Attacks via Malicious Agent Skills." pith.science (2026). https://pith.science/paper/2605.09594

@misc{pith2026260509594,
  author       = {Pith},
  title        = {Pith review of: Trust Me, Import This: Dependency Steering Attacks via Malicious Agent Skills},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/2605.09594}},
  note         = {Machine review of arXiv:2605.09594}
}
read the original abstract

LLM-powered coding agents increasingly make software supply chain decisions. They generate imports, recommend packages, and write installation commands. Prior work showed that these systems can hallucinate non-existent package names, which attackers may register as malicious packages. In this paper, we show that this risk is not only a passive model failure. It can be actively induced through the persistent Skill artifact. We introduce Dependency Steering, an attack paradigm in which a malicious Skill biases a coding agent toward an attacker-controlled package during benign coding tasks. The attack does not require modifying model weights, training data, or user prompts. To construct realistic attacks, we design a Skill-level optimization method that searches for localized semantic edits that preserve the apparent purpose of the original Skill while increasing targeted package generation. Across multiple coding-oriented LLMs and programming benchmarks, Dependency Steering achieves high targeted hallucination rates, transfers across models and task domains, and remains difficult for evaluated Skill scanners and LLM-based auditors to detect. Our results show that persistent agent instructions form an underexplored software supply chain attack surface.

Figures

Figures reproduced from arXiv: 2605.09594 by the authors.

Figure 1
Figure 1. Overview of our attack scenario. the generated dependency is accepted, the malicious package can compromise the developer environment. Constructing such attacks is non-trivial: a naive instruction such as “always import package X” is conspicuous and likely to be detected. A realistic malicious Skill must instead increase the probability that the target package appears in generated code while preserving the apparent … view at source ↗
Figure 2
Figure 2. Transferability performance of our attack across mod [PITH_FULL_IMAGE:figures/full_fig_p009_2.png] view at source ↗
Figure 4
Figure 4. Domain transferability performance of our attack, [PITH_FULL_IMAGE:figures/full_fig_p010_4.png] view at source ↗
Figures from the paper (4 more)
Figure 3
Figure 3. Figure 3: Comparison of THRs on training and test prompts [PITH_FULL_IMAGE:figures/full_fig_p010_3.png]
Figure 5
Figure 5. Figure 5: Comparison of THRs of our method across models [PITH_FULL_IMAGE:figures/full_fig_p010_5.png]
Figure 6
Figure 6. Figure 6: THRs across repeated runs for each model under [PITH_FULL_IMAGE:figures/full_fig_p011_6.png]
Figure 7
Figure 7. Figure 7: Targeted hallucination rates (THRs) across models [PITH_FULL_IMAGE:figures/full_fig_p016_7.png]

Discussion (0). Sign in to comment.

Lean theorems connected to this paper

Citations machine-checked in the Pith Canon. Every link opens the source theorem in the public Lean library.

What do these tags mean?
matches
The paper's claim is directly supported by a theorem in the formal canon.
supports
The theorem supports part of the paper's argument, but the paper may add assumptions or extra steps.
extends
The paper goes beyond the formal theorem; the theorem is a base layer rather than the whole result.
uses
The paper appears to rely on the theorem as machinery.
contradicts
The paper's claim conflicts with a theorem or certificate in the canon.
unclear
Pith found a possible connection, but the passage is too broad, indirect, or ambiguous to say the theorem truly supports the claim.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Setup Complete, Now You Are Compromised: Weaponizing Setup Instructions Against AI Coding Agents

    cs.CR 2026-07 conditional novelty 6.0 of 10

    AI coding agents often install malicious or vulnerable packages described in project docs; detection depends on the harness-model pair, and source-based attacks are missed almost everywhere.

Reference graph

Works this paper leans on

57 extracted references · 57 canonical work pages · cited by 1 Pith paper

  1. [1]

    Repairagent: An autonomous, llm-based agent for program repair,

    I. Bouzenia, P. Devanbu, and M. Pradel, “Repairagent: An autonomous, llm-based agent for program repair,” in2025 IEEE/ACM 47th Inter- national Conference on Software Engineering (ICSE), 2025, pp. 2188– 2200

    work page 2025

  2. [2]

    You name it, i run it: An llm agent to execute tests of arbitrary projects,

    I. Bouzenia and M. Pradel, “You name it, i run it: An llm agent to execute tests of arbitrary projects,”Proc. ACM Softw. Eng., vol. 2, no. ISSTA, Jun. 2025. [Online]. Available: https://doi.org/10.1145/3728922

    work page doi:10.1145/3728922 2025

  3. [3]

    SWE-agent: Agent-computer interfaces enable automated software engineering,

    J. Yang, C. E. Jimenez, A. Wettig, K. Lieret, S. Yao, K. R. Narasimhan, and O. Press, “SWE-agent: Agent-computer interfaces enable automated software engineering,” inThe Thirty-eighth Annual Conference on Neural Information Processing Systems, 2024. [Online]. Available: https://openreview.net/forum?id=mXpq6ut8J3

    work page 2024

  4. [4]

    Github copilot,

    GitHub, “Github copilot,” https://github.com/features/copilot, 2026, ac- cessed: 2026-05-06

    work page 2026

  5. [5]

    Anysphere, “Cursor,” https://cursor.com/, 2026, accessed: 2026-05-06

    work page 2026

  6. [6]

    Claude code overview,

    Anthropic, “Claude code overview,” https://code.claude.com/docs/en/ overview, 2026, accessed: 2026-05-06

    work page 2026

  7. [7]

    Introducing codex,

    OpenAI, “Introducing codex,” https://openai.com/index/ introducing-codex/, 2025, accessed: 2026-05-06

    work page 2025

  8. [8]

    Gemini code assist overview,

    Google, “Gemini code assist overview,” https://developers.google.com/ gemini-code-assist/docs/overview, 2026, accessed: 2026-05-06

    work page 2026

Show all 57 references
  1. [9]

    We have a package for you! a comprehensive analysis of package hallucinations by code generating llms,

    J. Spracklen, R. Wijewickrama, A. H. M. N. Sakib, A. Maiti, B. Viswanath, and M. Jadliwala, “We have a package for you! a comprehensive analysis of package hallucinations by code generating llms,” inUSENIX Security Symposium, 2025

    2025

  2. [10]

    Beyond typosquatting: An in-depth look at package confusion,

    S. Neupane, G. Holmes, E. Wyss, D. Davidson, and L. D. Carli, “Beyond typosquatting: An in-depth look at package confusion,” in32nd USENIX Security Symposium (USENIX Security 23). Anaheim, CA: USENIX Association, Aug. 2023, pp. 3439–3456. [Online]. Available: https: //www.usen...

    2023

  3. [11]

    Small world with high risks: A study of security threats in the npm ecosystem,

    M. Zimmermann, C.-A. Staicu, C. Tenny, and M. Pradel, “Small world with high risks: A study of security threats in the npm ecosystem,” in28th USENIX Security Symposium (USENIX Security 19). Santa Clara, CA: USENIX Association, Aug. 2019, pp. 995–1010. [Online]. Available: http...

    2019

  4. [12]

    A survey on hallucination in large language models: Principles, taxonomy, challenges, and open questions,

    L. Huang, W. Yu, W. Ma, W. Zhong, Z. Feng, H. Wang, Q. Chen, W. Peng, X. Feng, B. Qin, and T. Liu, “A survey on hallucination in large language models: Principles, taxonomy, challenges, and open questions,”ACM Trans. Inf. Syst., vol. 43, no. 2, Jan. 2025. [Online]. Available: ...

    2025 doi

  5. [13]

    Survey of hallucination in natural language generation,

    Z. Ji, N. Lee, R. Frieske, T. Yu, D. Su, Y . Xu, E. Ishii, Y . J. Bang, A. Madotto, and P. Fung, “Survey of hallucination in natural language generation,”ACM Comput. Surv., vol. 55, no. 12, Mar. 2023. [Online]. Available: https://doi.org/10.1145/3571730

    2023 doi

  6. [14]

    Importing phantoms: Measuring llm package hallucination vulnerabilities,

    A. Krishna, E. Galinkin, L. Derczynski, and J. Martin, “Importing phantoms: Measuring llm package hallucination vulnerabilities,” 2025. [Online]. Available: https://arxiv.org/abs/2501.19012

    2025

  7. [15]

    Llm hallucinations in practical code generation: Phenomena, mechanism, and mitigation,

    Z. Zhang, C. Wang, Y . Wang, E. Shi, Y . Ma, W. Zhong, J. Chen, M. Mao, and Z. Zheng, “Llm hallucinations in practical code generation: Phenomena, mechanism, and mitigation,”Proc. ACM Softw. Eng., vol. 2, no. ISSTA, Jun. 2025. [Online]. Available: https://doi.org/10.1145/3728894

    2025 doi

  8. [16]

    Skills | claude,

    Anthropic, “Skills | claude,” https://claude.com/skills, 2026, accessed: 2026-05-07

    2026

  9. [17]

    Skills | openai api,

    OpenAI, “Skills | openai api,” https://developers.openai.com/api/docs/ guides/tools-skills, 2026, accessed: 2026-05-07

    2026

  10. [18]

    Skill-inject: Measuring agent vulnerability to skill file attacks,

    D. Schmotz, L. Beurer-Kellner, S. Abdelnabi, and M. Andriushchenko, “Skill-inject: Measuring agent vulnerability to skill file attacks,” 2026. [Online]. Available: https://arxiv.org/abs/2602.20156

    2026

  11. [19]

    Malicious agent skills in the wild: A large- scale security empirical study,

    Y . Liu, Z. Chen, Y . Zhang, G. Deng, Y . Li, J. Ning, Y . Zhang, and L. Y . Zhang, “Malicious agent skills in the wild: A large- scale security empirical study,” 2026. [Online]. Available: https: //arxiv.org/abs/2602.06547

    2026

  12. [20]

    Credential leakage in llm agent skills: A large-scale empirical study,

    Z. Chen, Y . Zhang, Y . Liu, G. Deng, Y . Li, Y . Zhang, J. Ning, L. Y . Zhang, L. Ma, and Z. Li, “Credential leakage in llm agent skills: A large-scale empirical study,” 2026. [Online]. Available: https://arxiv.org/abs/2604.03070

    2026 arXiv

  13. [21]

    Rules | cursor docs,

    Cursor, “Rules | cursor docs,” https://cursor.com/docs/rules, 2026, ac- cessed: 2026-05-07

    2026

  14. [22]

    Introduction to rules, memories, & workflows,

    Windsurf, “Introduction to rules, memories, & workflows,” https:// windsurf.com/university/general-education/intro-rules-memories, 2026, accessed: 2026-05-07

    2026

  15. [23]

    Assistantagent | autogen 0.2,

    Microsoft, “Assistantagent | autogen 0.2,” https://microsoft.github.io/ autogen/0.2/docs/reference/agentchat/assistant_agent/, 2026, accessed: 2026-05-07

    2026

  16. [24]

    Prompt template format guide - langsmith docs,

    LangChain, “Prompt template format guide - langsmith docs,” https:// docs.langchain.com/langsmith/prompt-template-format, 2026, accessed: 2026-05-07

    2026

  17. [25]

    Not what you’ve signed up for: Compromising real- world llm-integrated applications with indirect prompt injection,

    K. Greshake, S. Abdelnabi, S. Mishra, C. Endres, T. Holz, and M. Fritz, “Not what you’ve signed up for: Compromising real- world llm-integrated applications with indirect prompt injection,” in Proceedings of the 16th ACM Workshop on Artificial Intelligence and Security, ser. A...

    2023 doi

  18. [26]

    InjecAgent: Benchmarking indirect prompt injections in tool-integrated large language model agents,

    Q. Zhan, Z. Liang, Z. Ying, and D. Kang, “InjecAgent: Benchmarking indirect prompt injections in tool-integrated large language model agents,” inFindings of the Association for Computational Linguistics: ACL 2024, L.-W. Ku, A. Martins, and V . Srikumar, Eds. Bangkok, Thailand:...

    2024

  19. [27]

    Agentdojo: A dynamic environment to evaluate prompt injection attacks and defenses for LLM agents,

    E. Debenedetti, J. Zhang, M. Balunovic, L. Beurer-Kellner, M. Fischer, and F. Tramèr, “Agentdojo: A dynamic environment to evaluate prompt injection attacks and defenses for LLM agents,” inThe Thirty-eight Conference on Neural Information Processing Systems Datasets and Benchm...

    2024

  20. [28]

    Poisonedrag: knowledge corruption attacks to retrieval-augmented generation of large language models,

    W. Zou, R. Geng, B. Wang, and J. Jia, “Poisonedrag: knowledge corruption attacks to retrieval-augmented generation of large language models,” inProceedings of the 34th USENIX Conference on Security Symposium, ser. SEC ’25. USA: USENIX Association, 2025

    2025

  21. [29]

    Confusedpilot: Confused deputy risks in rag-based llms,

    A. RoyChowdhury, M. Luo, P. Sahu, S. Banerjee, and M. Tiwari, “Confusedpilot: Confused deputy risks in rag-based llms,” 2024. [Online]. Available: https://arxiv.org/abs/2408.04870

    2024

  22. [30]

    Poison-rag: Adversarial data poisoning attacks on retrieval-augmented generation in recommender systems,

    F. Nazary, Y . Deldjoo, and T. d. Noia, “Poison-rag: Adversarial data poisoning attacks on retrieval-augmented generation in recommender systems,” inAdvances in Information Retrieval, C. Hauff, C. Macdonald, D. Jannach, G. Kazai, F. M. Nardini, F. Pinelli, F. Silvestri, and N....

    2025

  23. [31]

    Neurogenpoisoning: Neuron-guided attacks on retrieval-augmented generation of LLM via genetic optimization of external knowledge,

    H. Zhu, L. Fiondella, J. Yuan, K. Zeng, and L. Jiao, “Neurogenpoisoning: Neuron-guided attacks on retrieval-augmented generation of LLM via genetic optimization of external knowledge,” inThe Thirty-ninth Annual Conference on Neural Information Processing Systems, 2026. [Online...

    2026

  24. [32]

    Iterative generation of adversarial example for deep code models,

    L. Huang, W. Sun, and M. Yan, “Iterative generation of adversarial example for deep code models,” in2025 IEEE/ACM 47th International Conference on Software Engineering (ICSE), 2025, pp. 2213–2224

    2025

  25. [33]

    C. E. Rasmussen,Gaussian Processes in Machine Learning. Berlin, Heidelberg: Springer Berlin Heidelberg, 2004, pp. 63–71. [Online]. Available: https://doi.org/10.1007/978-3-540-28650-9_4

    2004 doi

  26. [34]

    A new view of automatic relevance determination,

    D. Wipf and S. Nagarajan, “A new view of automatic relevance determination,” inAdvances in Neural Information Processing Systems, J. Platt, D. Koller, Y . Singer, and S. Roweis, Eds., vol. 20. Curran Associates, Inc., 2007. [Online]. Available: https://proceedings.neurips.cc/p...

    2007

  27. [35]

    AutoDAN-turbo: A lifelong agent for strategy self-exploration to jailbreak LLMs,

    X. Liu, P. Li, G. E. Suh, Y . V orobeychik, Z. Mao, S. Jha, P. McDaniel, H. Sun, B. Li, and C. Xiao, “AutoDAN-turbo: A lifelong agent for strategy self-exploration to jailbreak LLMs,” inThe Thirteenth International Conference on Learning Representations, 2025. [Online]. Availa...

    2025

  28. [36]

    Llama-3.1-foundationai-securityllm-8b-instruct technical report,

    S. Weerawardhena, P. Kassianik, B. Nelson, B. Saglam, A. Vellore, A. Priyanshu, S. Vijay, M. Aufiero, A. Goldblatt, F. Burch, E. Li, J. He, D. Kedia, K. Oshiba, Z. Yang, Y . Singer, and A. Karbasi, “Llama-3.1-foundationai-securityllm-8b-instruct technical report,” 2025. [Onlin...

    2025

  29. [37]

    Phi-4-mini technical report: Compact yet powerful multimodal language models via mixture-of-loras,

    Microsoft, :, A. Abouelenin, A. Ashfaq, A. Atkinson, H. Awadalla, N. Bach, J. Bao, A. Benhaim, M. Cai, V . Chaudhary, C. Chen, D. Chen, D. Chen, J. Chen, W. Chen, Y .-C. Chen, Y . ling Chen, Q. Dai, X. Dai, R. Fan, M. Gao, M. Gao, A. Garg, A. Goswami, J. Hao, A. Hendy, Y . Hu,...

    2025 arXiv

  30. [38]

    Qwen2.5-coder technical report,

    B. Hui, J. Yang, Z. Cui, J. Yang, D. Liu, L. Zhang, T. Liu, J. Zhang, B. Yu, K. Lu, K. Dang, Y . Fan, Y . Zhang, A. Yang, R. Men, F. Huang, B. Zheng, Y . Miao, S. Quan, Y . Feng, X. Ren, X. Ren, J. Zhou, and J. Lin, “Qwen2.5-coder technical report,” 2024. [Online]. Available: ...

    2024 arXiv

  31. [39]

    Learning word vectors for 157 languages,

    E. Grave, P. Bojanowski, P. Gupta, A. Joulin, and T. Mikolov, “Learning word vectors for 157 languages,” inProceedings of the Eleventh International Conference on Language Resources and Evaluation (LREC 2018), N. Calzolari, K. Choukri, C. Cieri, T. Declerck, S. Goggi, K. Hasid...

    2018

  32. [40]

    Introducing the ai agent security scanner for ides,

    Cisco, “Introducing the ai agent security scanner for ides,” https://blogs.cisco.com/ai/ introducing-the-ai-agent-security-scanner-for-ides-verify-your-agents, 2026, accessed: 2026-05-07

    2026

  33. [41]

    (2026) Skillrisk — free ai agent skill security scanner

    SkillRisk. (2026) Skillrisk — free ai agent skill security scanner. [Online]. Available: https://skillrisk.org/

    2026

  34. [42]

    Skillcheck by repello ai | ai skill vulnerability scanner,

    Repello AI, “Skillcheck by repello ai | ai skill vulnerability scanner,” https://skills.repello.ai/, 2026, accessed: 2026-05-07

    2026

  35. [43]

    Y ARA: The pattern matching swiss knife for malware researchers,

    V . M. Álvarez, “Y ARA: The pattern matching swiss knife for malware researchers,” https://yara.readthedocs.io, 2013

    2013

  36. [44]

    Snyk agent red teaming,

    Snyk, “Snyk agent red teaming,” https://docs.snyk.io/ developer-tools/snyk-cli/scan-and-maintain-projects-using-the-cli/ snyk-agent-red-teaming, 2026, accessed: 2026-05-07

    2026

  37. [45]

    Ai agent vulnerabilities — free skill scanner,

    Mondoo, “Ai agent vulnerabilities — free skill scanner,” https://mondoo. com/use-cases/ai-agent-vulnerabilities, 2026, accessed: 2026-05-07

    2026

  38. [46]

    Skillprobe: Security auditing for emerging agent skill marketplaces via multi-agent collaboration,

    Z. Guo, Z. Chen, X. Nie, J. Lin, Y . Zhou, and W. Zhang, “Skillprobe: Security auditing for emerging agent skill marketplaces via multi-agent collaboration,”arXiv preprint arXiv:2603.21019, 2026

    2026

  39. [47]

    Gpt-4.1 sets the standard in automated experiment design using novel python libraries,

    N. Fachada, D. Fernandes, C. M. Fernandes, B. D. Ferreira-Saraiva, and J. P. Matos-Carvalho, “Gpt-4.1 sets the standard in automated experiment design using novel python libraries,”Future Internet, vol. 17, no. 9, p. 412, 2025. [Online]. Available: http://dx.doi.org/10.3390/fi17090412

    2025 doi

  40. [48]

    Introducing sandyclaw — the first dynamic sandbox for ai agent skills and prompts,

    Permiso Security, “Introducing sandyclaw — the first dynamic sandbox for ai agent skills and prompts,” https://permiso.io/blog/ introducing-sandyclaw-dynamic-sandbox-ai-agent-skills, 2026, accessed: 2026-05-07

    2026

  41. [49]

    Openhands: An open platform for AI software developers as generalist agents,

    X. Wang, B. Li, Y . Song, F. F. Xu, X. Tang, M. Zhuge, J. Pan, Y . Song, B. Li, J. Singh, H. H. Tran, F. Li, R. Ma, M. Zheng, B. Qian, Y . Shao, N. Muennighoff, Y . Zhang, B. Hui, J. Lin, R. Brennan, H. Peng, H. Ji, and G. Neubig, “Openhands: An open platform for AI software d...

    2025

  42. [50]

    On faithfulness and factuality in abstractive summarization,

    J. Maynez, S. Narayan, B. Bohnet, and R. McDonald, “On faithfulness and factuality in abstractive summarization,” inProceedings of the 58th Annual Meeting of the Association for Computational Linguistics, D. Jurafsky, J. Chai, N. Schluter, and J. Tetreault, Eds. Online: Associ...

    2020

  43. [51]

    A comprehensive survey of hallucination in large language, image, video and audio foundation models,

    P. Sahoo, P. Meharia, A. Ghosh, S. Saha, V . Jain, and A. Chadha, “A comprehensive survey of hallucination in large language, image, video and audio foundation models,” inFindings of the Association for Computational Linguistics: EMNLP 2024, Y . Al-Onaizan, M. Bansal, and Y .-...

    2024

  44. [52]

    Understanding and detecting hallucinations in neural machine translation via model introspection,

    W. Xu, S. Agrawal, E. Briakou, M. J. Martindale, and M. Carpuat, “Understanding and detecting hallucinations in neural machine translation via model introspection,”Transactions of the Association for Computational Linguistics, vol. 11, pp. 546–564, 2023. [Online]. Available: h...

    2023

  45. [53]

    Donapi: malicious npm packages detector using behavior sequence knowledge mapping,

    C. Huang, N. Wang, Z. Wang, S. Sun, L. Li, J. Chen, Q. Zhao, J. Han, Z. Yang, and L. Shi, “Donapi: malicious npm packages detector using behavior sequence knowledge mapping,” inProceedings of the 33rd USENIX Conference on Security Symposium, ser. SEC ’24. USA: USENIX Association, 2024

    2024

  46. [54]

    Journey to the center of software supply chain attacks,

    P. Ladisa, S. E. Ponta, A. Sabetta, M. Martinez, and O. Barais, “Journey to the center of software supply chain attacks,”IEEE Security & Privacy, vol. 21, no. 6, pp. 34–49, 2023

    2023

  47. [55]

    Backstabber’s knife collection: A review of open source software supply chain attacks,

    M. Ohm, H. Plate, A. Sykosch, and M. Meier, “Backstabber’s knife collection: A review of open source software supply chain attacks,” inDetection of Intrusions and Malware, and Vulnerability Assessment: 17th International Conference, DIMVA 2020, Lisbon, Portugal, June 24–26, 20...

    2020

  48. [56]

    Research directions in software supply chain security,

    L. Williams, G. Benedetti, S. Hamer, R. Paramitha, I. Rahman, M. Tamanna, G. Tystahl, N. Zahan, P. Morrison, Y . Acar, M. Cukier, C. Kästner, A. Kapravelos, D. Wermke, and W. Enck, “Research directions in software supply chain security,”ACM Trans. Softw. Eng. Methodol., vol. 3...

    2025 doi

  49. [57]

    Ty- posquatting and combosquatting attacks on the python ecosystem,

    D.-L. Vu, I. Pashchenko, F. Massacci, H. Plate, and A. Sabetta, “Ty- posquatting and combosquatting attacks on the python ecosystem,” in 2020 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW), 2020, pp. 509–514. APPENDIX A. Convergence Analysis To analyze th...

    2020

Pith tools

Reviewed May 12, 2026 · model on record in the stance chip above.