# Research papers by Liran Tal

Co-authored preprints on agent skill security, AI vulnerability review, and dependency remediation. Abstracts, full author credits, PDFs, and DOIs.

Canonical: https://lirantal.com/research/papers

October 2026

arXiv · Preprint

### [VulnBump: A Benchmark for Fixing Vulnerable Dependencies in Real Projects While Keeping the Build and Tests Green ↗](https://arxiv.org/abs/2610.17374)

A benchmark of 307 dependency upgrades across 43 repositories, evaluating whether AI agents fix vulnerabilities while preserving successful builds and tests.

Gabija Pasiunaite, Ryan McMorrow, Brian Clark, Liran Tal, and Luke Tu

[Read PDF](https://arxiv.org/pdf/2610.17374) [DOI: 10.48550/arXiv.2610.17374](https://doi.org/10.48550/arXiv.2610.17374)

June 2026

arXiv · Preprint

### [Snyk VulnBench JS 1.0: Can LLMs Find the Same Bugs Twice? ↗](https://arxiv.org/abs/2606.15762)

Repeated vulnerability scans on JavaScript code explore the consistency of LLM security review and how it complements deterministic static analysis.

Liran Tal, Johannes Kloos, Arsenii Rudich, Stephen Thoemmes, and Manoj Nair

[Read PDF](https://arxiv.org/pdf/2606.15762) [DOI: 10.48550/arXiv.2606.15762](https://doi.org/10.48550/arXiv.2606.15762)

May 2026

arXiv · Preprint

### [Technical Report: Exploring the Emerging Threats of the Agent Skill Ecosystem ↗](https://arxiv.org/abs/2605.28588)

An analysis of 3,984 agent skills, documenting malicious payloads, credential theft, and the security risks of emerging skill marketplaces.

Luca Beurer-Kellner, Aleksei Kudrinskii, Marco Milanta, Kristian Bonde Nielsen, Hemang Sarkar, and Liran Tal

[Read PDF](https://arxiv.org/pdf/2605.28588) [DOI: 10.48550/arXiv.2605.28588](https://doi.org/10.48550/arXiv.2605.28588)