arXiv AI
Encrypted Skills Can Become New Security Exploits If AI Agents Know How to Decipher
Read the original on arXiv AI →The Flow has not summarised this story yet — read it at arXiv AI.
Related stories
arXiv AI
Aug 6
Behavioral Skill Reconstruction: Reconstructing Hidden Functionality from LLM Agent Skills
arXiv:2608. 04192v1 Announce Type: cross Abstract: Closed source agent skills may encode proprietary instructions, scripts, constants, and data.
arXiv Computation and Language
Aug 25
SkillBloat: Token Amplification Attacks via Skill Injection in LLM Coding Agents
The paper "SkillBloat: Token Amplification Attacks via Skill Injection in LLM Coding Agents" investigates how agent skills—task‑specific instructions, scripts, and resources—can be exploited to create a trusted instruction channel that enables token amplification attacks. It introduces a two‑phase framework, SkillBloat, which first screens a library of attack‑type conditions across multiple amplification mechanisms and then refines the strongest candidate through LLM‑guided full‑document skill rewriting. Evaluated on a real‑world skill benchmark, SkillBloat achieves an average best amplification of 5.4184×–10.1455× across multiple coding‑agent target configurations, and an ablation study shows that the second‑stage refinement consistently improves performance over the initial screening alone.
arXiv AI
Oct 15
One Skill, Two Masters: Serving Users and Attackers through Skill Injection
The paper introduces PERSIST, a method that allows attackers to inject malicious actions into large language model agents by linking attacker-chosen actions to useful functions while minimizing source inspection and suspicion. PERSIST builds helper functions from simulated executions and embeds them in separate modules, enabling the agent to perform both user tasks and attacker objectives. Experiments on SkillsBench and Skill-Inject demonstrate that frozen skill packages transfer across multiple agent–model configurations, generalize to unseen tasks, and increase harmful-effect rates compared to baselines.
arXiv AI
Jun 2
"Do Not Mention This to the User": Detecting and Understanding Malicious Agent Skills
arXiv:2602. 06547v3 Announce Type: replace-cross Abstract: LLM-based coding agents increasingly rely on third-party extensions called skills, which bundle natural language instructions and helper scripts that execute with full user privileges.
arXiv AI
Oct 15
SkillScreen: High-Recall Screening of Malicious Agent Skills with Decision Models
arXiv:2610.17727v2 Announce Type: cross Abstract: Agent skills turn natural-language instructions into actions, creating a security challenge: legitimate automation and malicious behaviour can look d...
arXiv AI
Jun 17
SkillJect: Effectively Automating Skill-Based Prompt Injection for Skill-Enabled Agents
arXiv:2602. 14211v3 Announce Type: replace-cross Abstract: Agent skills extend LLM agents with task-specific instructions, executable scripts, and auxiliary resources, improving reusability but creating a new supply-chain attack surface.