You might think you’ve just given an AI Agent a new skill. In reality, you may also have inadvertently removed human approval.
A study of public GitHub repositories scanned around 1.53 million English-language Agent skills and found that about 88,000 contained instructions that could bypass human review.
That works out to roughly 1 in every 17 skills containing this kind of instruction.
Most concerning of all:
70.1% of these instructions don’t distinguish between usage scenarios.
For example:
* Execute and push changes without confirmation.
* Don’t ask questions along the way; keep going until the task is complete.
* Handle every step automatically, without human intervention.
If instructions like these are written into a SKILL.md file, an Agent loading that skill could act directly at steps that would normally require human confirmation.
Even more troubling, existing security scanners may not catch them.
The study tested two open-source scanners from Cisco and NVIDIA. Even when using GPT-5.4, their highest detection rate was only 46%, with precision below 0.4.
But change the way you ask the question, and the results are markedly different:
Instead of asking the model, “Is this a malicious instruction?”, ask, “Does it bypass human review?” The detection rate rises to 61%, and precision reaches 0.71.
This points to a problem:
Agent security reviews can’t focus only on malicious code. They also need to check instructions that may appear to be merely about improving automation efficiency.
The study’s recommendations are straightforward:
1. Set clear limits on instructions that trigger automatic execution—for example, allow them to take effect only in a CI environment.
2. When reviewing skills, focus on whether they bypass human confirmation, not just on scanning for malicious code.
3. Don’t let a single unconditional instruction determine an Agent’s behavior in every scenario.
Agents are becoming more capable—and gaining more and more permissions.
But some steps shouldn’t stop requiring human confirmation just because someone wrote, “Keep going until it’s done.”
Truly reliable automation doesn’t eliminate every check. It knows when it needs to stop and ask a person.
A study of public GitHub repositories scanned around 1.53 million English-language Agent skills and found that about 88,000 contained instructions that could bypass human review.
That works out to roughly 1 in every 17 skills containing this kind of instruction.
Most concerning of all:
70.1% of these instructions don’t distinguish between usage scenarios.
For example:
* Execute and push changes without confirmation.
* Don’t ask questions along the way; keep going until the task is complete.
* Handle every step automatically, without human intervention.
If instructions like these are written into a SKILL.md file, an Agent loading that skill could act directly at steps that would normally require human confirmation.
Even more troubling, existing security scanners may not catch them.
The study tested two open-source scanners from Cisco and NVIDIA. Even when using GPT-5.4, their highest detection rate was only 46%, with precision below 0.4.
But change the way you ask the question, and the results are markedly different:
Instead of asking the model, “Is this a malicious instruction?”, ask, “Does it bypass human review?” The detection rate rises to 61%, and precision reaches 0.71.
This points to a problem:
Agent security reviews can’t focus only on malicious code. They also need to check instructions that may appear to be merely about improving automation efficiency.
The study’s recommendations are straightforward:
1. Set clear limits on instructions that trigger automatic execution—for example, allow them to take effect only in a CI environment.
2. When reviewing skills, focus on whether they bypass human confirmation, not just on scanning for malicious code.
3. Don’t let a single unconditional instruction determine an Agent’s behavior in every scenario.
Agents are becoming more capable—and gaining more and more permissions.
But some steps shouldn’t stop requiring human confirmation just because someone wrote, “Keep going until it’s done.”
Truly reliable automation doesn’t eliminate every check. It knows when it needs to stop and ask a person.