In a November 6 Sophos research preview, Younghoo Lee described a way to detect agent skills whose helper code does more than the instructions say. The talk was scheduled for BSides Sydney on November 7. The proposed check decodes the code into facts first and asks a small model to judge those facts against the skill's stated purpose.
Why is a skill description insufficient?
Agent skills can contain instructions alongside scripts that carry out work. The SKILL.md describes the intended task. A description may say the skill summarizes a spreadsheet, while its helper code can access files, the network or a shell using the agent's permissions. The reader sees the stated task, but the machine acts on the code. Obfuscation makes that difference harder to spot in review.
How do decoding and judgment work together?
Sophos describes a deterministic stage that tries to recover what the code will do. A language model then compares those recovered behaviors with the declared purpose. The model does not have to infer the meaning of every encoded string and make a security judgment at the same time. The researchers also trained small Qwen3 models so inference could run locally without an external API.
What did the study test?
Sophos used a synthetic benchmark of benign and malicious skills with multiple obfuscated versions of each. The split was based on the original skill, so a disguised version of a test skill did not appear in training. That checks whether the approach works on held-out examples in the benchmark. It does not establish detection rates across a live marketplace or against unfamiliar forms of obfuscation.
Teams using outside skills can treat the method as a design for an additional review step. The useful decision is which actions need inspection or permission before a skill can run, especially when its code asks for access unrelated to the task.
SAILLENT covers a different point in the workflow: enforcing policies on actions that go through its runtime integration.
