Preliminary research
RCE in Your Test Suite: AI Agent Skills and the Attack Vector Skill Scanners Miss
AI-collected research leads through 2 October 2026, including bounded month-by-month reviews of selected social and community sources from March through September. Unranked, incomplete, not community-vetted, and subject to change.
Shows that AI-agent skill installers can copy unreferenced test files into dot-directories that skill scanners ignore. Jest, Vitest and similar recursive collectors later execute those files, turning an apparently inert installed skill into a delayed supply-chain code-execution path.
Record
- Researcher
- Jeevan Jutla
- Published by
- Gecko Security
- Date
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of Jeevan Jutla, first published at the original source. Preserved copies are kept so the citation survives its host.