arXiv AI
Aug 11
ColluSkill: Adversarial Cross-Skill Composition for Evading Agent Skill Scanners
arXiv:2608. 09732v1 Announce Type: cross Abstract: Agent skills are emerging as an important attack surface in LLM-based agent systems.
Defense-as-Skill: Evolving Runtime Guard Skill for Skill-Augmented Agents
Related stories
arXiv AI
Aug 24
ClawSentry: A Progressive Multi-Tier Security Monitor for Safeguarding Autonomous LLM Agents
ClawSentry is an open‑source, framework‑agnostic security supervision gateway designed to protect autonomous large language model (LLM) agents from progressive risks that can arise at four points in the agent control loop: skill admission, invocation‑time intent, execution‑time effect, and post‑action consequence. It introduces a multi‑tier decision engine—deterministic L1, rule‑anchored L2, and read‑only L3—alongside a First‑Use Skill Package Review (FSPR) and an Agent Harness Protocol (AHP) that applies a single policy across multiple agent runtimes without modifying their internals. Evaluation on SkillInject and the SkillsSafety benchmark shows that ClawSentry significantly reduces contextual adversarial skill risk (ASR) while maintaining high task success rates (TSR).
arXiv AI
Aug 14
Practice Makes Unsafe: Skill Misevolution in Self-Improving LLM Agents
arXiv:2608. 12851v1 Announce Type: new Abstract: Self-improving LLM agents convert successful trajectories into persistent cross-task state.
arXiv AI
Sep 1
Reachability-Based Capability Confinement for LLM Agents under Indirect Prompt Injection
arXiv:2608.30041v1 Announce Type: cross Abstract: Large language model agents place outputs from external skills into their execution context, allowing attacker-controlled data to influence later pri...
arXiv AI
Jun 16
Benign in Isolation, Harmful in Composition: Security Risks in Agent Skill Ecosystems
arXiv:2606. 15242v1 Announce Type: cross Abstract: Skills are becoming the capability layer through which LLM agents turn plans into actions, but their use introduces security risks such as data leakage, unauthorized operations, and tool misuse.
arXiv AI
Oct 2
Chaining Skills to Hijack LLM Agents
The paper "Chaining Skills to Hijack LLM Agents" introduces APEX, a method that constructs adversarial skill chains to manipulate large language model agents into performing attacker-selected actions. By exploiting the sequential invocation of open-source skills, APEX creates a record of genuine task progress that falsely signals user approval, enabling downstream skills to carry out malicious actions. Experiments on SkillsBench and GPT‑5.4 show high success rates, and a prompting defense reduces but does not eliminate the threat.
arXiv AI
Oct 1
Hiding in Plain Sight: Decoupling Pretext from Actuation for Skill Poisoning in LLM Agents
The paper introduces a new skill poisoning technique for large language model agents that decouples the pretext (rationale) from the actuation (operation). By separating these two risk‑realization factors, the authors create coordinated pretext‑actuation skill pairs that allow malicious actions to remain hidden within legitimate agent behavior. An automated framework is presented to discover execution dependencies, synthesize these skill pairs, and refine them through closed‑loop feedback, achieving high attack success in both single‑session and persistent scenarios.
arXiv AI
Oct 1
Can Agents Trust Their Skills? Uncovering Unsafe Chains of Trust in Skill-Based LLM Agents
arXiv:2609.39065v1 Announce Type: cross Abstract: LLM agents increasingly rely on installable skills, which are packages of instructions, code, and resources that equip them with task-specific capabi...
arXiv AI
Aug 19
TRUSS: Towards Task-Reliable and User-Safe Automated Agent Skill Generation
TRUSS is a framework that generates and verifies automated agent skills, ensuring they are both functionally effective and safe. It evaluates candidate skills against source evidence and nine safety properties, then tests them in a controlled environment to capture execution traces and identify failures. The system iteratively refines skills based on these results, achieving high precision in vulnerability detection and significantly improving task performance and security rates.
arXiv AI
Oct 1
ActionGuard: Tool Call Authorization under Poisoned Skills
arXiv:2609.39450v1 Announce Type: cross Abstract: LLM-based agents extend their capabilities through third-party skills that provide task-specific instructions, scripts, and tool-use procedures. Howe...
arXiv AI
Sep 28
Stealth Apart, Harm Together: Skill Cascading Attacks on Skill-Based Agent Systems
The paper introduces skill cascading attacks, where a malicious goal is spread across multiple seemingly benign skills, causing harmful outcomes when combined. It presents SkillCascade, an automated red‑teaming framework, and releases SkillCascade‑Bench, a benchmark of 213 validated cascading test cases across various agent systems and domains. Experiments show that these cascaded interactions reliably induce harmful behaviors while evading existing per‑skill scanners and runtime monitors, revealing a gap between component‑level integrity and system‑level safety.
arXiv AI
Jun 2
When Safe Skills Collide: Measuring Compositional Risk in Agent Skill Ecosystems
arXiv:2606. 00448v1 Announce Type: cross Abstract: LLM agents increasingly rely on community-contributed skills that expand an agent's operational capability set.