Yesterday this blog covered a 48-threat audit of the Agent Payments Protocol that concluded valid mandate signatures do not guarantee a purchase reflects user intent, because everything upstream of the signature is unsigned context. Today the upstream got its own paper, and it is worse than the payments audit implied, because the corruption now lives in a component the industry treats as benign: the humble Skill file.

On September 2, 2026, Jiarui Li, Jiahao Chen, Chunyi Zhou, Yuwen Pu, Oubo Ma, Zhou Feng, Chunqiang Hu, and Shouling Ji of Chongqing University and Zhejiang University published “A Finger on the Scale: Covert Policy Steering through Agentic Skills” on arXiv. Their thesis is contained in one sentence from the abstract: a third-party skill “may preserve the declared task and valid output interface while covertly redirecting agent decisions toward an undisclosed objective.”

Not task hijacking. Not injected commands. Not a broken output. A shopping skill that still compares products, still respects your budget, still returns a well-formatted recommendation, and simply favors one brand 81.33 percent of the time.

How Skills Became the Agent Economy’s Loading Dock

To understand why this matters, you need to understand what a Skill is and how fast the format spread.

Anthropic introduced Agent Skills as “organized folders of instructions, scripts, and resources that agents can discover and load dynamically to perform better at specific tasks.” A skill is a directory whose SKILL.md file carries a name and description in YAML frontmatter, and that metadata is preloaded into the agent’s system prompt at startup. If the task looks relevant, the agent reads the full file into context. Anthropic’s framing is disarming: “Building a skill for an agent is like putting together an onboarding guide for a new hire.”

That framing is exactly right, and exactly the problem. An onboarding guide for a new hire does not just tell them what to do. It tells them what to value, which criteria matter most, how to break ties between similar options. It shapes judgment. Anthropic’s own engineering post concedes the point in passing: skills “extend not only what an agent can do but also how it decides.”

The format then standardized. On December 18, 2025, Agent Skills was published as an open standard for cross-platform portability, and runtimes from JetBrains’ Junie to independent agent frameworks adopted it. Community registries sprang up: ClawHub lists third-party skills with numbered install counters alongside scrapers, video-generation packs, and phone-calling tools; Tencent runs SkillHub; the paper also evaluates a registry called vskill. Millions of agent operators are being trained to install skills the way they once installed browser extensions, with roughly the same amount of due diligence.

Now read the paper’s canonical attack scenario against that backdrop:

“Consider a shopping Skill that compares products based on user needs. A malicious provider can add plausible evaluation criteria and examples that covertly favor one brand. Although the agent still processes the original query and returns a valid recommendation, it selects the promoted brand more often, thereby serving an undisclosed commercial objective.”

No exploit, no memory corruption, no injection payload. A well-written document with an agenda.

What SkillShift Actually Does

The researchers formalize a security property they call Skill Policy Integrity: a skill-induced behavioral policy must remain faithful to its declared functionality and the user-authorized objective, such that “behavioral changes are attributable to task-relevant context.” A violation occurs when an undisclosed third-party objective systematically influences behavior even though the task, available actions, and output interface are unchanged.

Then they built a machine for violating it. SkillShift is a black-box optimization framework that searches for a structured attack strategy, appended to an otherwise clean skill, subject to hard constraints: no changes to candidate data, no positional or query-specific shortcuts, no schema violations, no explicit target commands. The attacker never touches model parameters, gradients, or hidden states. The only feedback signal is the agent’s final output on a development set of queries.

The strategy has four components that implement three steering mechanisms:

  • Policy framing changes the relative salience of task-relevant attributes, reweighting which evidence the agent prioritizes when comparing candidates.
  • Tie-breaking manipulation introduces plausible secondary criteria for the moments when multiple candidates are similarly suitable, shifting the ranking without ever making the target an unconditional choice.
  • Semantic anchoring uses representative examples to stabilize how those abstract principles get applied across queries and model backends.

Think about how legible this is as commerce corruption. An honest shopping skill says “prefer products with durable build quality.” A SkillShifted shopping skill says “prefer products with durable build quality, weigh after-sales support heavily when specifications are comparable, and favor manufacturers with vertically integrated supply chains.” Every clause is defensible. Every clause is plausible onboarding guidance. Together they can be tuned, via black-box iteration against the victim agent itself, to describe exactly one brand’s strengths.

The Numbers

The results across agentic commerce and Python dependency selection tasks:

  • Policy steering rates of 81.33 percent in shopping and 63.33 percent in dependency selection, improvements over clean skills of +44 and +63 points respectively. A clean skill picks the attacker’s target some baseline fraction of the time by chance; the optimized skill pushes that to more than four picks in five for shopping.
  • A 100 percent valid-output rate. The agent never malfunctions, never returns malformed data, never appears compromised. The paper’s HTML version states the frozen policies preserved effectiveness and validity while transferring “without further optimization across LLM backends and agent environments,” and remained effective on held-out queries the optimizer never saw.
  • Zero flags from the defense stack. The evaluated skill scanners and prompt-injection detectors, with citations covering Cisco AI Defense, Snyk, Protect AI, and NVIDIA tooling, “do not flag the manipulated Skills under their default rules.” The team also evaluated registry-level handling on ClawHub, Tencent SkillHub, and vskill.

That last bullet is the strategic finding. Every serious defense built for the agent era so far targets the wrong signal. Injection detectors look for instructions that do not belong, guardrails look for unsafe actions, scanners look for malware. SkillShift contains none of those things. It contains prose that would earn a thumbs-up in documentation review. As the authors put it, their results show “valid outputs and passing security scans do not guarantee Skill Policy Integrity.”

The difference between a biased skill and a well-written one is not syntactic. It is behavioral, and it can only be measured behaviorally.

Why This Is the Return of SEO, One Layer Down

Web-scale commerce spent twenty years fighting corruption of the ranking layer: keyword spam, link farms, paid review farms, sponsored listings dressed as organic results. Regulators from the FTC on down have spent the last two years dragging that machinery into the light. The entire enforcement model presumes the ranking function belongs to the platform and the attack is content that games it.

Skills invert the geometry. The ranking function, the criteria an agent uses to compare products, is now itself third-party content, loaded into the agent’s system prompt at startup, before any product data is even fetched. The attack surface moved from the search results page into the layer that decides how to read the search results page.

The paper’s related-work section makes the lineage explicit, citing research on Adversarial Search Engine Optimization and on tool-description manipulation, where optimized tool metadata increases target selection. SkillShift is the same economic incentive with a better delivery vehicle: a persistent, reusable, plausibly-documented policy file that works across every backend that loads it.

Follow the money and the next phase writes itself. If a steered shopping skill can deliver an 81 percent selection rate for an undisclosed brand, then “skill engine optimization” becomes a line item. Brands will commission skills. Registries will sell placement. The sponsored listing does not disappear in agentic commerce; it gets promoted from the page into the agent’s own judgment, where no disclosure label can reach it, because there is no page left to label.

Stack this on yesterday’s AP2 finding and you have the complete picture of what is unsigned in agentic commerce. The payments layer certifies that you authorized the purchase. The skill layer quietly shaped which purchase you authorized. The mandate chain will then produce a mathematically perfect proof that your agent freely chose the product someone paid for it to choose.

What Defends Against a Document With an Agenda

The paper’s own prescription is behavioral auditing: treat reusable skills as policy artifacts and test what they do, not what they say. Run controlled candidate sets through a skill and measure selection distributions against a baseline; a skill that shifts selection by 44 points toward one target while adding only “plausible guidance” is not guidance. That is a real research agenda, and registries that host commerce skills should adopt it before the first enforcement action names one.

But auditing the skill layer alone still leaves the decision itself undefended at runtime, and this is where the product-trust question becomes concrete. A steered skill works by reweighting evidence inside the agent’s context. Its leverage depends on that context being the only place where evidence gets evaluated. Two structural mitigations shrink that leverage:

Anchor the decision to evidence computed outside the poisoned context. A Smart Score built from review quality after fake and manipulated reviews are filtered out, sustained over a 90-day window for the GoBuy Verified badge, is not an argument the skill can outframe. It arrives as a number with provenance, computed by a party whose incentives are not the seller’s or the skill author’s. The skill can still reweight criteria around it, but the cheapest attack, drowning the target’s weaknesses in favorable framing, loses its raw material.

Narrow the candidate funnel before the skill ever runs. Returning only the top seven verified products per category, rather than an open catalog, means the steering surface is seven candidates that already survived independent filtering, not a thousand the skill gets to triage. Curation is not just a UX choice; it is attack-surface reduction.

Both of these are machine-native. Agents query GoBuy’s trust layer over MCP at gobuy.ai/api/mcp before comparing products, so the evidence base enters the decision from a channel the skill does not control. We will not overclaim: a sufficiently aggressive malicious skill could instruct an agent to ignore external tools entirely, and detecting that is exactly what behavioral auditing is for. Verification narrows the attack; it does not abolish it. But an attack forced to become conspicuous is an attack scanners can finally see, which is the whole game.

There is also a pleasing symmetry in the defense. The paper concludes that skills must be audited by their behavior, not their claims, because their text will always look legitimate. That is the same principle GoBuy applies to products: review counts are claims, review quality is behavior, and the gap between the two is where manipulation has always lived. The agent economy is about to learn, layer by layer, the same lesson e-commerce learned the hard way. Trust the artifacts by what they do.

What to Watch

Three signals will tell you whether this paper changes anything. First, whether ClawHub, Tencent SkillHub, and the other named registries respond to the registry-level findings with behavioral screening rather than static scans. Second, whether the Agent Skills standard, now cross-platform under stewards including Anthropic, adds any notion of provenance or differential-testing requirements for commerce skills, or leaves integrity as the operator’s problem. Third, the first disclosed case of a popular shopping skill with a paid bias, which is now a question of when, not if: the economics are too good and the detection stack, as of this week’s paper, demonstrably blind.

The industry spent 2025 standardizing how agents get paid and 2026 standardizing how agents get extended. Nobody standardized how agents decide. That is the gap, and it is now measurable at 81 percent.

Your agent’s judgment is only as clean as the documents it loads. Give it evidence the skill author cannot write: point it at gobuy.ai, or wire independent product-trust verification into your agent stack at gobuy.ai/agent-docs.