Scanner finds local and composite vulnerabilities in public agent skills
Original title: Scan Before You Install: Detecting and Mitigating Local and Composite Vulnerabilities in Skills
Analysts confirmed 53 of 59 GitHub findings, and mitigations blocked attacks in 47 of 55 tested cases.
Researchers built a six-module scanner for unintended vulnerabilities and multi-skill interactions in LLM agent skills. Local analysis reached 95.90% recall on a 556-case SkillTrustBench subset and an F1 of 0.947 on 1,000 MalSkillBench skills. In 1,587 skills from 75 highly starred GitHub repositories, analysts confirmed 53 of 59 findings. Composite analysis scored 0.991 F1 on SCR-Bench and found two GitHub cases, both validated with proof-of-concept attacks. The authors disclosed 10 medium- and high-severity cases and tested mitigations on others.
Unconfirmed: The paper does not say whether any vulnerability was exploited by attackers outside the study.
- Confirmed findings spanned 23 repositories, with reported precision of 89.8%.
- Researchers developed a proof-of-concept attack for each identified vulnerability.
- Ten medium- and high-severity cases were disclosed to maintainers.
- For 47 of 55 GitHub findings, mitigations blocked attacks while preserving tested functions.
- Composite analysis outperformed three SkillsGuard configurations on SCR-Bench.
Impact: Unsafe execution through vulnerable or interacting agent skills
| Product | Affected |
|---|---|
| LLM agent skills | 1,587 skills from 75 GitHub repositories |
- 1.Apply the paper's recommended skill substitution, patches, or configuration changes where applicable.
- Organizations
- GitHub
From the original article
1 min read at arxiv.orgAn agent skill packages natural-language instructions, scripts, and reference files that an LLM-based agent loads for a task. Skills may access the file system, shell, and network under user-authorized permissions; weaknesses can lead to unsafe execution.
By Parth A. Gandhi · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.