ActionGuard: Tool Call Authorization under Poisoned Skills
ActionGuard authorizes LLM agent tool calls before execution, cutting skill-injection success versus prior safeguards.
Researchers present ActionGuard, which inspects skill-influenced LLM-agent tool calls immediately before execution. The reviewer does not see potentially poisoned skill text and instead judges each action using the trusted user request, a balanced skill profile, recent calls, and local scripts. On 139 contextual and 180 obvious injections, it cut attack success 35.54 to 46.11 percent versus Dynamic Guardian and SkillGuard, and 70.44 percent versus no safeguard, while benign task completion stayed high. Decisions are enforced fail-closed at OpenClaw's before-tool-call stage.
- Separates the agent's planning context from the reviewer's authorization context
- Reviewer never receives the raw, potentially poisoned skill text
- Tested on 139 contextual and 180 obvious skill injections
- Attack success fell 70.44 percent versus having no safeguard
From the original article
1 min read at arxiv.orgLLM-based agents extend their capabilities through third-party skills that provide task-specific instructions, scripts, and tool-use procedures. However, malicious instructions inserted into an otherwise benign skill can cause a benign user request to trigger dangerous Tool Calls, including data exfiltration, file deletion, or unauthorized code execution.
By Jihun Han · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.