SCS finds 627 malicious agent skills in 66,157 ClawHub packages
Original title: From Instructions to Exploits: Applying Program Analysis to Malicious Agent Skills Across Natural Language and Code
On a balanced 234-skill benchmark it reached 85.6% accuracy, 95.2% recall and 86.9% F1.
Researchers present SCS, a static scanner that compiles agent-skill instructions into a constrained intermediate representation and links them with bundled code in a cross-domain dependence graph. A trust-sensitivity-capability model then flags risk. Scanning ClawHub produced 2,473 candidates, and auxiliary dynamic checks plus manual review confirmed 627 as malicious.
- The labeled benchmark contains 117 malicious and 117 benign skills.
- Average precision was 80.2% across five LLMs.
- Average token consumption was 13.7 million.
- The instruction compiler was 92.5% to 94.5% correct on 400 annotated steps.
Impact: malicious third-party skills can ship harmful instructions and code
From the original article
1 min read at arxiv.orgLLM-powered agents increasingly rely on third-party skills that combine natural-language instructions with executable code, creating supply-chain risks that may span both artifacts. Existing skill scanners often rely on rule matching or direct LLM judgments and provide limited support for tracing such cross-domain behavior.
By Shiwu Zhao · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.