- JFrog argues that agent skills, plugins and packages carry plain-English instructions that code, dependency and secret scanners may miss. JFrog sells AI security products.
- JFrog cites an unnamed July 2026 study in which the strongest cloaking technique evaded each of eight scanners, which JFrog does not identify, more than 90% of the time.
- Ask who approves skills, whether review covers the instructions as well as the scripts, and which credentials a coding agent can reach.
The risk is a sentence, not a bug
Many conventional security tools hunt for flawed code. A newer kind of file holds mostly instructions, written in plain English, for an AI coding agent to follow. A recent post from the software supply chain company JFrog makes that argument. It deserves attention from anyone who funds developer tooling. JFrog sells AI security products, so this is a vendor's view.
The lesson here is that what gets installed has changed. A skill is not only code to run. It is text that steers an agent, and the agent can act with the access its developer already has. JFrog argues that scanners built for code have little to read in the instructions themselves. Skills do ship with scripts, and JFrog says its Xray product covers those, along with dependencies and known CVEs. The gap JFrog describes is the instruction text.
What a skill is, and why it may slip past the usual checks
In JFrog's description, a skill is a bundle that a coding agent loads into its working context. Its core is usually a file named SKILL.md, with a few scripts next to it. It guides the agent on jobs such as handling an incident, reviewing a pull request or shipping a release.
Plugins go wider. One install from an agent's marketplace can bring skills, MCP servers (connectors that let an agent use outside tools) and other parts. JFrog also describes agent package managers (APM), an emerging open standard. A single manifest file names the skills, prompts and MCP servers a team needs, each with a version. One install command then gives every developer the same agent.
JFrog says three standard checks may not catch this layer. Software composition analysis (SCA) checks third-party components for known flaws. Static analysis (SAST) reads source code for mistakes. Secret scanners look for exposed credentials. JFrog's point is that a harmful sentence gives these tools nothing to match: no component list to check and no program logic to trace.
Why text can act like a program
Once a skill is loaded into an agent's context, its words can shape what the agent does next. JFrog says the agent holds the developer's repository access, cloud credentials and production privileges. An agent can carry out an instruction in a skill with those rights. JFrog's argument is that no exploit is needed.
JFrog offers an illustration, not a real incident. Hidden in an otherwise normal skill, one line could ask the agent to read its AWS credentials file before finishing and paste the contents into its summary, "so the user can verify the configuration." JFrog says no CVE exists for this, because the line is valid Markdown. It adds that the agent can then repeat the behaviour on each teammate's machine that cloned the file.
JFrog also says people rarely vet skills closely. Installers often trust a teammate's Slack recommendation or a plugin from a familiar source. JFrog lists four threat classes: prompt injection, hidden instructions placed so a reviewer skims past them, encoded payloads that decode into commands, and credential exfiltration.
The research behind the claim
JFrog cites July 2026 research by an unnamed team. The post does not name the researchers or link the paper, so treat the figures as JFrog's account. According to JFrog, the team built a framework that rewrote a malicious skill's suspicious tokens, commands and credential paths. The real payload stayed concealed until the agent executed the skill.
The test used 1,613 malicious skills already found in the wild and eight scanners. JFrog says the strongest technique evaded each scanner more than 90% of the time. That figure applies to the best technique, not to every cloaked skill. JFrog describes the eight only as scanners, and says static scanners cleared some skills as safe. It does not say they were SCA, SAST or secret scanners. The study therefore does not show that those tool classes fail.
JFrog adds that in the researchers' tests the disguised skills kept working inside production agents such as Claude Code and Codex. It reports no measurable drop in task success.
What JFrog proposes, and what to weigh
JFrog recommends three steps. First, scan for both code problems and intent. Deterministic scanning catches known flaws and signatures. Semantic scanning has an AI-powered scanner interpret the instruction text from the agent's point of view. Second, turn each verdict into policy: block malicious assets, send suspicious ones to review, let the rest in. Third, enforce the policy each time the agent uses an asset, not only at download.
The third step shows why one-time approval falls short. JFrog's example is a skill that passes review in March and is reclassified as a problem in April. If checks run only at the gate, that skill keeps working on machines that already have it. JFrog says its Agent Guard enforces policy where the agent reaches for the asset.
Our own reasoning adds two cautions. The semantic scanner is also a model reading text. The cloaking in the cited study rewrites wording to look harmless, so it may be aimed at that kind of reader too. JFrog does not say whether any of the eight scanners worked this way. The post also gives no detection rates for its own scanner.
The attack has limits as well. The agent must load the skill, the model must follow the line, and the credentials must be within reach. The last condition is the one a company controls most directly.
Questions to put to your teams
Ask who may install a skill, plugin or agent package, and where approved copies live. Ask whether review covers the instructions or only the scripts beside them. Ask whether a skill flagged today stops working on laptops that installed it last month. Ask which credentials a coding agent can reach, because that sets the cost of one bad sentence. Scanning may fail, so narrow access is the safer backstop.
If JFrog's argument and the unnamed research hold, a Markdown file deserves the scrutiny given to a program. The evidence is one vendor blog and one study it does not name. Treat it as a reason to ask these questions, not as proof of a gap in your own setup.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: JFrog.
