A swapped Python cache file let malicious agent skills past seven security scanners in 94–100% of attacks, a new paper finds

Agent “skills” are packages that give an AI agent new abilities, and scanners check them before they are installed by reading their documentation and visible source code. A paper first listed on arXiv on 9 October, submitted on 7 October by Jie Liao, Simeng Qin, Wenqi Ren, Wei Zhou, Junhao Wen, Ranjie Duan, Yang Liu and Xiaojun Jia, shows how that check can be sidestepped.

Python can run a bundled bytecode cache instead of the source file. PyCache Trap pairs harmless source with a substituted cache that the loader accepts. The abstract reports: “Across 100 skills and seven scanners, PyCache Trap achieves 94-100% attack success”.

The authors also propose a defence, execution-aware validation, which they say “detects all 100 evaluated source-present cache substitutions and reaches 92.8% Recall at 10.0% FPR” across five attack families and 200 benign skills.

The abstract does not name the scanners tested. For anyone running agent skill marketplaces or installing third-party skills, the point is simple: a scanner that reads the source but not what Python will actually execute can be shown one thing while the agent runs another.

• Confirmed Across 100 skills and seven scanners, PyCache Trap achieves 94–100% attack success. arXiv 2610.10612
• Confirmed The proposed execution-aware validation detects all 100 evaluated cache substitutions and reaches 92.8% recall at a 10.0% false-positive rate. arXiv 2610.10612