Towards a Risk Assessment of Malicious Skill Files in Coding Agents

This collection primarily covers software engineering research. The main security-relevant work assesses malicious skill files loaded by autonomous coding agents, showing that natural-language skill interfaces can conceal shell commands and enable agent compromise. The study reports high exploitation rates across Gemini CLI and Qwen Code, low explicit safety recognition, a benchmark mapped to 11 MITRE ATT&CK tactics, and recommends enterprise risk assessment and mitigation before adopting coding agents. Other papers address debugging, WebAssembly discrepancy repair, software validation, test生成