Important read if you build with agent skills. Shared skill libraries are treated as a safe way for coding agents to reuse each other's work. New research shows they propagate malware. EvoMal plants a malicious skill in the library and never invokes it. The agent retrieves it as an authoring template, writes a new skill that preserves the payload, stores it, and runs it. Each authored copy re-enters the library and gets imitated again. Across six models on 153 tool-relevant SWE-bench…