The paper investigates oversight‑loosening directives embedded in AI agent skills—reusable instruction packages centered on a SKILL.md file. Analyzing 1.53 million English skills from GitSkills, the authors find that roughly one in seventeen skills (about 88,000) contains a directive that bypasses checks or approvals, often via permission flags and applied unconditionally. The study shows that such directives cluster in a small number of upstream skills and that current open‑source scanners miss most of them, while an LLM‑based detector performs better.
arXiv:2609.05677v1 Announce Type: cross Abstract: Lifelong LLM agents increasingly rely on external skill artifacts as one element for preserving and reusing capabilities over time. These skills (usu...
The paper introduces a six‑module scanner for detecting unintended local and composite vulnerabilities in LLM‑based agent skills. Local Analysis achieved high recall and precision on benchmark datasets, outperforming existing scanners, while Composite Analysis accurately modeled inter‑skill dependencies and identified composite flaws. The authors validated findings with proof‑of‑concept attacks, disclosed cases to maintainers, and demonstrated effective mitigations that preserved legitimate functionality.
The paper investigates how co-installed coding‑agent skills can conflict, causing the model to choose a similar skill over the intended one based solely on name and description. An empirical study of 20,947 repositories uncovered 822,109 candidate skill pairs, with 312 confirmed conflicts tested across three models, revealing that nearly one in four installed skills is overridden by a similar skill. Key findings include that conflicts often involve normative skills, that the installed skill loses core functions in about one‑fifth of runs, and that the first skill read determines the outcome, suggesting benchmarks should evaluate exclusive core functions and platforms should guard the initial read.
TRUSS is a framework that generates and verifies automated agent skills, ensuring they are both functionally effective and safe. It evaluates candidate skills against source evidence and nine safety properties, then tests them in a controlled environment to capture execution traces and identify failures. The system iteratively refines skills based on these results, achieving high precision in vulnerability detection and significantly improving task performance and security rates.
ClawSentry is an open‑source, framework‑agnostic security supervision gateway designed to protect autonomous large language model (LLM) agents from progressive risks that can arise at four points in the agent control loop: skill admission, invocation‑time intent, execution‑time effect, and post‑action consequence. It introduces a multi‑tier decision engine—deterministic L1, rule‑anchored L2, and read‑only L3—alongside a First‑Use Skill Package Review (FSPR) and an Agent Harness Protocol (AHP) that applies a single policy across multiple agent runtimes without modifying their internals. Evaluation on SkillInject and the SkillsSafety benchmark shows that ClawSentry significantly reduces contextual adversarial skill risk (ASR) while maintaining high task success rates (TSR).
arXiv:2608. 11727v1 Announce Type: new Abstract: When a coding agent obeys a rule, it may simply have been going to do that anyway.
arXiv:2608. 05204v1 Announce Type: new Abstract: LLM-agent ecosystems are rapidly growing around reusable skills: mixed-modality packages of metadata, natural-language instructions, code, tools, references, and operational workflows.
TRUSS is a framework that generates and verifies automated agent skills, ensuring they are both functionally effective and safe. It first checks functional claims against evidence and evaluates artifacts against nine safety properties, then tests admitted skills in a controlled environment to capture execution traces and identify failures. The approach achieves perfect precision and recall in vulnerability detection, significantly reduces attack success rates, and boosts task effectiveness and security rates in skill generation benchmarks.
arXiv:2607. 01136v1 Announce Type: cross Abstract: Agent skills package reusable operational knowledge for Large Language Model (LLM) agents, yet as they grow in scope, they become dependency-bearing artifacts whose identities, versions, and provenance remain implicit.
arXiv:2606. 00448v1 Announce Type: cross Abstract: LLM agents increasingly rely on community-contributed skills that expand an agent's operational capability set.
arXiv:2608. 11888v1 Announce Type: new Abstract: Agent skills are the de facto mechanism for extending LLM agents with reusable guidance.
arXiv:2610.35082v1 Announce Type: cross Abstract: Agent Skills allow LLM agents to combine reusable capabilities, but checking each Skill in isolation cannot rule out policy violations when they are...