AI assistants now take real actions, like editing code. People stay in control because the assistant asks before acting. are reusable instruction files; a line in a widely copied skill can switch those checkpoints off.
The authors studied a large collection of skills, hand-labelled a sample of instructions, and trained a program to automate the search. About one in seventeen skills contains one: an instruction telling the agent to skip approval, bypass checks, or work without checking in.
Current scanners catch at most 46% of these directives because they look for malicious content. A told-not-to-ask agent will not ask before acting on a mistake or an attacker's hidden instruction. Asking a model specifically about oversight works better.