Do AI Agent Skills Stay Safe Across Languages?

TL;DR — Short answer: no. Public AI agent skills differ by language — English skills lean toward technical/infrastructural capabilities, Chinese skills lean toward media, social, and finance applications — and their safety signals are uneven. A meaningful share of public skills are already flagged as suspicious or malicious, and cross-lingual obfuscation (homoglyphs, invisible characters, mixed scripts) can hide intent from detectors tuned to one language. Safety has to be evaluated per-language, not assumed to transfer.

Agent "skills" are the plugin economy for AI agents: packaged, shareable capabilities — instructions plus code — that anyone can publish to a registry and anyone can install. That openness is powerful and, like every open package ecosystem before it, it is an attack surface.

Why look across languages?

Most security analysis of agent skills implicitly assumes one language (usually English). But skill registries are global. If the composition and the safety signals of skills differ by language, then a safety pipeline validated on English skills can be blind to risks that show up elsewhere.

What the cross-lingual picture looks like

Analyzing public skills by language surfaces a clear split in what they do:

• English skills — more heavily oriented toward technical and infrastructural capabilities (dev tooling, system tasks).
• Chinese skills — more strongly organized around downstream application scenarios: media, social platforms, and finance-related workflows.

Different functional mixes imply different threat models. A finance-workflow skill and a dev-tooling skill fail in different ways, so a one-size-fits-all detector under-covers whichever language it wasn't tuned for.

Risk is already here

This is not a hypothetical. A considerable portion of skills in public registries are flagged as suspicious or malicious by available platform signals — and many records still suffer from incomplete observability, meaning the true rate is likely under-counted. The current safety pipeline is informative but far from comprehensive.

The cross-lingual attack surface

Language is not just metadata; it is an evasion vector. Cross-lingual obfuscation and Unicode abuse — mixed-script content, homoglyph substitutions, zero-width and invisible characters, and right-to-left/left-to-right overrides — can smuggle malicious behavior past detectors in both the instructions and the code of a skill. Detection has to reason about mixed scripts explicitly, not normalize them away.

Safety that is only measured in one language is safety you cannot claim in every language.

Where this connects

Untrusted skills are exactly the kind of input an audit layer exists to police at runtime: inspect what a skill actually tries to do — read files, exfiltrate data, call sensitive tools — before it executes, in any language.

Frequently asked questions

What is an AI agent skill?

A packaged, shareable capability (instructions + code) that extends an agent, distributed through public registries like plugins — which makes the registry itself an attack surface.

Do skills have the same safety in every language?

No — English and Chinese skills differ in what they do and in their safety signals, so safety must be evaluated per-language.

What cross-lingual attacks matter?

Mixed-script content, homoglyphs, invisible characters, and RTL/LTR overrides that hide malicious intent from single-language detectors.

---

Written by Aojie (Justin) Yuan. "Do Agent Skills Speak Safety in Every Language?" is a poster at AgentSkills @ ACM CAIS 2026 (OpenReview).