Cloak and Detonate: Scanner Evasion and Dynamic Detection of Agent Skill Malware
Abstract: LLM coding agents increasingly rely on third-party agent skills from public marketplaces, which execute with the agent's privileges and create a software supply-chain attack surface: a malicious skill can steal credentials, exfiltrate source code, or install backdoors. Existing defenses use static skill scanners based on pattern matching or LLM-as-judge analysis, but it remains unclear whether they withstand adaptive evasions that preserve malicious behavior while changing payload appearance. This paper first presents an adversarial study of existing skill scanners through SkillCloak, a payload-preserving evasion framework that keeps the attack semantics intact while transforming their visible form. SkillCloak uses two complementary strategies: Structural Obfuscation, which rewrites visible payload indicators into semantically equivalent forms, and Self-Extracting Skill (SFS) Packing, which hides malicious components from the install-time view and restores them during agent execution. Across eight scanners and 1,613 in-the-wild malicious skills, SFS Packing bypasses every scanner at over 90%, while Structural Obfuscation bypasses over 80% on most static scanners and reaches 96% on a hybrid scanner, showing that appearance-based auditing is insufficient. Motivated by this finding, we propose SkillDetonate, a behavior-centric runtime auditor that executes skills in a sandbox and detects malicious effects through OS-boundary information-flow evidence rather than install-time appearance. SkillDetonate combines on-demand closure lift, which observes instructions materialized during execution, with marker-based taint analysis, which tracks sensitive-data flows across the agent context, files, processes, and network operations. The results show that SkillDetonate detects 97% of attacks at a 2% false-positive rate and sustains 87% detection on real-world malicious skills.
Summary
- The paper proposes SkillCloak for evading static analysis and SkillDetonate for behavior-centric, dynamic detection of malicious agent skills.
- It demonstrates that SkillCloak achieves over 90% bypass rates—including up to 99.9% for static scanners—using structural obfuscation and SFS packing.
- SkillDetonate leverages OS-level taint analysis to dynamically detect malicious actions, achieving 97% detection on controlled benchmarks.
SkillCloak and SkillDetonate: Scanner Evasion and Dynamic Detection of Agent Skill Malware
Introduction and Problem Setting
The proliferation of LLM-based coding agents has resulted in the emergence of modular “agent skills,” composable packages distributed via public marketplaces that LLM agents can load dynamically to gain new functionalities. This extensibility, however, introduces a supply-chain threat vector: a skill, once installed, executes with the agent’s privileges, enabling credential theft, source exfiltration, and backdoor insertions by malicious actors. Existing defenses focus on install-time static analysis—either through pattern matching or LLM-based review—but their robustness against adversarial, semantics-preserving transformations remains underexplored.
Figure 1: Conceptual overview of SkillCloak (offensive evasion) and SkillDetonate (behavior-centric defense).
Design and Evaluation of SkillCloak
Evasion Methodology
SkillCloak operationalizes two complementary evasion strategies:
- Structural Obfuscation: This method rewrites payload signatures (e.g., command tokens, credential paths, URLs) to evade pattern/AST/LLM-based detection without modifying the executable payload. Obfuscations include unicode confusables, casing, sharding of tokens across files/lines, extension manipulation, and leveraging shell/Python dynamic resolution. The goal is to minimally perturb the skill structure while maximizing scanner bypass.
Figure 2: Workflow of Structural Obfuscation, transforming payloads while retaining their semantics.
- Self-Extracting Skill Packing (SFS Packing): This approach removes the entire malicious payload from the scanner’s semantic scope by moving it into directories/files that scanners ignore and installing a benign-appearing cover plus a decoder stub. Upon execution, the agent decodes and installs the full malicious payload in-memory, defeating all install-time static analyses.
Figure 3: SFS Packing encapsulates the original malicious workflow inside an install-time opaque blob, only extracting at runtime.
Adversarial Evaluation
Across a corpus of 1,613 in-the-wild, ground-truth-malicious skills curated from a public marketplace, SkillCloak is shown to break the defense-in-depth provided by eight real-world scanners (including hybrid and LLM-as-judge designs). SFS Packing achieves over 90% bypass against every scanner, with several static scanners surpassed at 99.8–99.9%. Structural Obfuscation yields 80–98% bypass rates, with hybrid models sometimes even more vulnerable.
Figure 4: Per-scanner bypass rate for SkillCloak across static, hybrid, and semantic/LLM-based auditors.
Notably, none of these evasive transformations impair the underlying utility or functionality of cloaked skills: systematic evaluation with production agents (OpenAI Codex and Claude Code) on a standardized multi-skill benchmark shows no statistically significant decrease in execution success rates or trajectory similarity.
Implications
These empirical results demonstrate a critical limitation of static skill auditing, especially when faced with dedicated adversaries. The contradiction is explicit: static and even LLM-based scanners are systematically circumvented by semantics-preserving disguise, yet the skills remain fully functional and thus operationally dangerous.
SkillDetonate: Dynamic, Behavior-Centric Detection
Motivating a Shift to Behavior
Given the demonstrated ineffectiveness of static and surface-level semantic checks, the detection paradigm must transition from appearance- to effect-based auditing. SkillDetonate is introduced as a dynamic auditor, focusing on OS-level information flow, specifically what a skill does during execution rather than its install-time appearance.
Figure 5: SkillDetonate's architecture: skill sandboxing, on-demand closure execution, and OS-level information-flow tracking via taint analysis.
Design Components
- On-Demand Closure Lift: Skills are not bound to their package at rest; they may dynamically generate new executable resources (e.g., SKILL.md) upon unpacking/decoding. SkillDetonate’s FUSE-backed mechanism recursively re-ingests and executes any such runtime materializations, ensuring multi-stage payloads are always detonated.
- Marker-Based Taint Analysis: Fine-grained, multi-plane tracking of sensitive data flows is performed. Marker tokens are injected during intercepted reads (e.g., credential pulls), and their propagation is observed across process boundaries, file/network exports, and agent context. Edge flows are reconstructed using eBPF syscall traces, and integrity/confidentiality violations are flagged if markers reach unauthorized sinks or destinations.
Detection Performance
On SkillJect (a prompt-injection-focused benchmark) and MalSkillBench (703 executable wild skills), SkillDetonate identifies 97% of attacks at a 2% false-positive rate in controlled settings and achieves 87.3% detection on wild samples, remaining robust to all SkillCloak evasions. Static and LLM-based baselines, in stark contrast, degrade by up to 90% under SFS Packing or structural obfuscation. False positives in benign skills are minimal due to precise information-flow tracking.
Failure analysis finds the primary root cause of missed malicious samples in the wild is NL agent coverage—that is, behaviors not triggered by the agent during sandboxed execution, not detector limitations.
Figure 6: Root cause analysis for missed detection in the wild, dominated by agent execution/instruction coverage gaps.
Ablation and Robustness
Ablation experiments confirm SkillDetonate’s two architectural novelties are individually load-bearing. Omitting on-demand closure lift eliminates detection of multi-stage packed skills; disabling taint analysis results in an eightfold surge in false positives. Notably, SkillDetonate also detects a broad class of independent evasions (VulMask), establishing generality.
Theoretical and Practical Implications
SkillCloak codifies the fundamental undecidability of perfect static detection in environments where the adversary can mutate the representational surface without altering underlying behavior, echoing classical results in malware research. SkillDetonate positions dynamic, behavior-centric analysis—rooted in OS-level information flow—as the practical trust gate for LLM agent ecosystems.
However, agent-driven execution leaves open the problem of natural-language coverage: malicious paths contingent on agent decisions or environmental state can evade detonator-driven traces. This challenge is analogous to forced execution in binary analysis and motivates the development of force-execution agents for NL-branch path coverage.
Static scanners, while insufficient alone, retain utility as hygiene prefilters. Structural hardenings such as post-install tree integrity attestation or blocking opaque/blob assets may marginally raise attacker cost but do not address coverage gaps inherent to the install-time paradigm.
Conclusion
This study demonstrates with strong empirical evidence that static and hybrid skill scanners are fundamentally inadequate against semantics-preserving evasions in the agent skill supply chain. SkillDetonate—by leveraging dynamic, behavior-centric information-flow auditing—achieves robust detection of both original and evasive skill malware. Further advances in agent instrumentation, force-execution for NL branches, and standardized sandboxes are warranted to fully close the execution coverage gap in next-generation LLM agent ecosystems.
Paper Prompts
Sign up for free to create and run prompts on this paper using GPT-5.
Top Community Prompts
Explain it Like I'm 14
What is this paper about?
This paper looks at a new kind of computer security risk that comes from “skills” used by AI coding assistants (LLM agents). These skills are small add‑ons you can install to give the AI new abilities, like running scripts or handling files. The problem is that bad actors can upload malicious skills to public marketplaces. If you install one, it can steal passwords, copy your code, or slip in backdoors.
The paper asks: Are the current safety checks good enough to spot these malicious skills, even when attackers try to hide? And if not, how can we do better?
What questions did the researchers ask?
They focused on two main questions:
- Can attackers change how a malicious skill “looks” without changing what it does, and still sneak past today’s skill scanners?
- Can we build a better detector that doesn’t just “look” at files before installation, but watches what a skill actually does when it runs?
How did they study it?
The team did two big things: they tested how to evade existing scanners, and they built a new kind of detector that watches behavior at runtime.
Part 1: SkillCloak — showing how attackers could hide
SkillCloak is a framework that keeps the bad behavior the same but changes its appearance so scanners won’t notice it. Think of it like disguises and secret packaging:
- Structural Obfuscation: This is like changing the wording of a suspicious note while keeping the meaning the same. The skill rewrites visible clues (like certain commands or URLs) so simple pattern checkers and even LLMs that “read” the files are fooled, but the agent still carries out the same harmful actions when run.
- Self‑Extracting Skill (SFS) Packing: This is like hiding dangerous items inside a sealed box that looks harmless, and only opening it later when you’re in a private room. The skill hides its malicious parts where scanners don’t look (for example, in ignored folders or encoded blobs), then “unpacks” them only when the agent actually runs the skill.
They tried these strategies on 1,613 real malicious skills and eight popular scanners.
Part 2: SkillDetonate — a detector that watches behavior
SkillDetonate takes a different approach: instead of only reading files before install, it runs the skill inside a safe, isolated environment (a sandbox) and watches what it does at the operating system level. Two ideas make this work for AI agents:
- On‑Demand Closure Lift: Some skills don’t show their full instructions until they’re running (they create new files or steps on the fly). SkillDetonate notices when new “instruction” files appear and feeds them back into the same monitored session. This is like letting the skill reveal all of its steps while you’re still watching it closely.
- Marker‑Based Taint Analysis: Imagine putting invisible glitter on sensitive data (like your SSH keys or credentials). If that glitter shows up later in a network request or a file it shouldn’t, you know that data was moved. SkillDetonate plants special markers when sensitive files are “read,” then tracks those markers across files, processes, and even the agent’s text context to see if the data flows to untrusted places (like unknown servers) or if untrusted code tries to modify important areas.
It then applies two simple policies:
- Confidentiality: Sensitive data shouldn’t leave to unapproved places on the internet.
- Integrity: The skill shouldn’t modify or install things outside approved locations.
What did they find?
Here are the key results, explained simply:
- Appearance-based scanners are easy to fool. When skills were “packed” (hidden and unpacked at runtime), they bypassed every tested scanner over 90% of the time. When skills were “obfuscated” (rewritten but did the same thing), they bypassed most scanners over 80% of the time, and up to 96% for one hybrid scanner.
- The disguised skills still worked. The researchers checked whether these changes broke the skill’s usefulness for real agents (like OpenAI Codex and Claude Code). They found no meaningful drop in success. In some cases, results even slightly improved. That means the attack stays just as dangerous while becoming harder to detect.
- Behavior-based detection works much better. SkillDetonate, which watches what the skill does when it runs, detected 97% of attacks on a benchmark with only a 2% false positive rate. On a set of real-world malicious skills, it caught 87%—and it stayed strong even when the attackers used the disguises that fooled the static scanners.
Why this is important: If a bad skill can easily dodge visual checks and still run perfectly, then relying only on pre-install scanning is risky. Watching behavior at runtime closes that gap.
What does this mean going forward?
- Static scanning is not enough. Tools that only look for suspicious text patterns or run a single pass with a LLM can be tricked by small rewrites or by hiding the payload until the skill runs.
- We need behavior-first defenses. Running skills in a safe sandbox and tracking where sensitive data goes (and what the skill tries to change) can catch attacks even when their appearance is cleverly disguised.
- Safer marketplaces for agent skills. As AI agents become more powerful and common, public skill stores should combine both approaches: keep static checks for quick screening, but use runtime, behavior-based auditing before granting full trust.
Simple takeaway
Bad skills can dress up in harmless clothing and slip past many current scanners, while still doing the same harmful things once installed. Instead of judging a skill by how it looks, judge it by what it does. SkillDetonate’s “watch it in a safe room and track the flow of sensitive data” approach catches far more threats and is a better fit for keeping AI coding agents safe.
Knowledge Gaps
Unresolved Gaps, Limitations, and Open Questions
The paper leaves several concrete gaps and open questions that future researchers can address:
- Threat model scope: The “self-containment” requirement excludes skills that stage remote payloads or leverage external compromised runtimes; evaluate SkillCloak/SkillDetonate against skills that fetch, compile, or assemble malicious components from the network post-install.
- Attacker capability beyond “payload markers”: Evasions that change or dynamically synthesize the attack’s target domains/paths/commands at runtime (e.g., remote config, DGA-like endpoints) may break the “payload marker” preservation assumption; quantify how often attacks can remain effective while altering markers beyond SkillCloak’s constraint.
- LLM judge reading scope assumptions: Offloading SKILL.md behind links presumes judges do not follow referenced paths; measure evasion resilience where auditors expand prompts to include linked files, references/, embedded archives, or perform recursive crawling.
- Scanner representativeness: The evaluated scanners are open-source; assess generalization against proprietary marketplace scanners and undisclosed hybrid pipelines using richer static and semantic analysis.
- Attack diversity coverage: Social engineering attacks were excluded from SkillJect; evaluate detection for prompt-only manipulations that cause harmful actions without reading sensitive files (e.g., misconfiguration, destructive edits, supply-chain poisoning via build scripts).
- Non-file secret sources: Current taint sources focus on filesystem paths (.env, ~/.ssh/); extend source instrumentation to OS keychain APIs, browser credential stores, cloud metadata endpoints (e.g., 169.254.169.254), environment variables, IPC, and device-specific stores (macOS Keychain, Windows Credential Manager).
- Environment variable and non-filesystem leaks: Detect flows that originate from inherited environment variables or agent-internal memory (not read via FUSE), including secrets provided via context, vault plugins, or agent connectors.
- Cross-OS portability: SkillDetonate is implemented/evaluated on Linux (eBPF/FUSE); assess portability to macOS and Windows where syscall tracing, file systems, and OS APIs differ substantially.
- Network egress fidelity: Without TLS interception, SkillDetonate infers confidential exfiltration via tainted process-to-socket edges; quantify false positives/negatives when benign processes read sensitive files and concurrently send unrelated traffic, and study selective egress inspection that remains privacy-preserving.
- Covert channels and side channels: Explore detection of exfiltration via DNS tunnels, timing channels, local steganography, or clipboard/GUI automation (e.g., screenshotting secrets), which may not be captured by inode-level taint or standard network sinks.
- Integrity policy completeness: The integrity policy allowlists trusted write locations and executables; study policy design for diverse toolchains (language-specific package managers, build systems) and the risk of under- or over-permissive configurations producing false alarms or misses.
- Instruction materialization heuristic: On-demand closure lift triggers on files with “instruction” extensions (e.g., .md); evaluate coverage when skills emit instructions in nonstandard media (compressed archives, PDFs, HTML, code comments, or binary blobs rendered by the agent).
- Multi-stage, time-delayed, and interactive workflows: Measure coverage when skills require user input, multi-session interactions, timers, or external service callbacks to release subsequent instructions or payloads; design sandbox orchestration to exercise such stages automatically.
- Anti-sandbox techniques: Investigate adversarial techniques that detect the sandbox (filesystem fingerprints, network patterns, cgroup/container artifacts) or stall/delay behavior to evade SkillDetonate’s single-session detonation.
- Mixed flows and partial derivations: Assess whether taint survives transformations that extract features rather than replicate content (hashes, embeddings, diffs, summaries), and whether confidentiality violations should include derived data leaving the system.
- Agent variability and non-determinism: The utility and detection experiments use two agents at “low reasoning effort”; measure robustness across diverse agent stacks, reasoning configurations, tool-use policies, and prompt management strategies.
- Benign corpus breadth: False-positive evaluation on only 150 benign SkillJect samples is limited; build a large, diverse benign skills corpus (multiple marketplaces, categories, languages) to characterize FP under real-world conditions.
- Scalability and throughput: Provide end-to-end performance and resource profiles for detonating at marketplace scale (e.g., 40k+ skills), including parallelization, queueing, caching, and maximum tolerable analysis time per skill for CI gating.
- Policy management automation: Develop methods to automatically infer sensitive-file sets, integrity allowlists, and trusted egress endpoints from organizational context, reducing manual tuning and drift.
- Language and runtime coverage: Structural Obfuscation operators focus on Python/shell; extend transformations (and corresponding dynamic detection coverage) to Node.js/TypeScript, Rust, Go, Java, compiled binaries, and polyglot skill bundles.
- Evasion against taint markers: Study attacks that attempt to strip or obfuscate SkillDetonate’s markers (e.g., normalization, token filtering, re-rendering in images) while preserving attack utility, and strengthen marker propagation to resist such laundering.
- Safety of detonation: The sandbox permits direct egress; analyze ethical and operational controls to prevent harm to third-party endpoints during detonation (rate limits, sinkhole domains, consent-based simulation), and measure impact on detection fidelity.
- Formal guarantees and coverage bounds: Provide formal models or empirical bounds for SkillDetonate’s information-flow tracking (across processes, encodings, and media), including conditions under which confidentiality/integrity violations are provably detected or might be missed.
Practical Applications
Immediate Applications
These applications can be implemented with today’s tools, using the paper’s methods as design blueprints or directly adapting the released artifacts.
- Bold: Runtime detonation gate for agent skills in CI/CD (software, DevSecOps, marketplaces)
- What: Automatically execute each third-party agent skill in a sandbox before approval, using OS-boundary information-flow checks (confidentiality/integrity) to gate installation.
- Tools/workflow: Docker sandbox; eBPF syscall tracing; FUSE-based “marker” filesystem; on-demand closure lift to execute materialized instructions; egress allowlist; CI plugins (e.g., GitHub Actions, Jenkins).
- Dependencies/assumptions: Linux hosts with eBPF and FUSE; ability to run the agent in a container; curated sensitive-file and egress allowlists; minor latency budget (tens of seconds per skill in the paper).
- Bold: “Agent EDR” extension on developer endpoints (software security, EDR/XDR vendors)
- What: Extend endpoint telemetry to track agent-driven file, process, and network flows; alert/block when tainted data (markers) reach non-allowlisted endpoints or when skills write/exec outside trusted paths.
- Tools/products: eBPF-based kernel sensor; process tagging for agent sessions; policy engine for confidentiality/integrity.
- Dependencies/assumptions: Kernel feature availability; vendor packaging; tuning to avoid FP against legitimate dev tooling (package managers, build systems).
- Bold: Marketplace vetting pipeline (AI agent platforms, app stores)
- What: Detonate submitted skills in a controlled environment and publish a “behavioral bill of materials” (BBOM) with pass/fail and observed egress/writes; block skills that violate policy even if they pass static scans.
- Workflow: Submission → detonation → policy evaluation → attested report → listing.
- Dependencies/assumptions: Standardized submission harness; scalable detonation farm; sandbox profiles per OS/agent variant.
- Bold: Developer IDE “skill sandbox” preview (developer tools)
- What: Before enabling a new skill in a coding agent, run a one-click local detonation that previews file changes, process launches, and egress targets; show a diff and a permit/deny prompt.
- Tools/products: IDE plugin; local Docker; minimal eBPF/FUSE bundle; human-in-the-loop approval flow.
- Dependencies/assumptions: Developer machine supports containerization/eBPF; UX that explains taint findings clearly.
- Bold: Secrets protection shim for agent sessions (daily life, enterprise IT)
- What: Mount a FUSE virtual filesystem for agent sessions that returns data markers instead of real secrets (e.g., ~/.ssh, cloud creds), preventing accidental exfiltration while preserving auditability.
- Tools/products: FUSE VFS; secrets broker/vault integration; per-session mount namespaces.
- Dependencies/assumptions: Some tools may fail if they require real secrets during detonation; policies must distinguish detonation vs production runs.
- Bold: Network egress control for agent runtimes (SOC/NOC, zero trust)
- What: Bind agent sessions to strict DNS/IP egress allowlists and alert on any attempt to contact non-declared endpoints; couple with data-marker evidence for high-fidelity detections.
- Workflow: Per-session microsegmentation; DNS+TLS SNI logging; correlation with taint events.
- Dependencies/assumptions: Accurate endpoint classification; handling of CDNs and ephemeral domains.
- Bold: Security red teaming with SkillCloak (security testing services, platform security)
- What: Use SkillCloak-style structural obfuscation and self-extracting packing to routinely evaluate how well in-house scanners resist semantics-preserving evasions; measure bypass rate drift.
- Tools/products: Adversarial test harness; regression suite of known-malicious skills; reporting to fix blind spots.
- Dependencies/assumptions: Controlled test environment; strong governance to prevent accidental spread of test malware.
- Bold: Incident response playbook for suspicious skills (SOC/DFIR)
- What: Reproduce and attribute effects by detonating the suspect skill in a lab; extract indicators from syscall graphs (e.g., domains, file paths, process trees) for containment and threat intel.
- Tools/workflow: Isolated sandbox; automated report with causal graph; export to SIEM/TI platforms.
- Dependencies/assumptions: Skill reproducibility; dataset of known benign/false-positive patterns for triage.
- Bold: Compliance and audit evidence for AI-assisted development (GRC, policy)
- What: Record detonation results and policies as part of supply-chain evidence (e.g., SOC 2, ISO 27001, SLSA attestations) before enabling skills in production.
- Tools/workflow: Signed detonation reports; policy baselines; audit trail retention.
- Dependencies/assumptions: Regulator/customer acceptance of dynamic-analysis artifacts; mapping to existing control catalogs.
- Bold: Academic benchmarking and reproducible research (academia)
- What: Build new benchmarks that mix synthetic and in-the-wild skills; evaluate dynamic analysis variants (policy sensitivity, closure lift ablations, taint precision); share artifacts.
- Tools/workflow: Open datasets; standardized harness; cross-lab replications.
- Dependencies/assumptions: Dataset licensing; safe handling of malicious samples.
Long-Term Applications
These require further research, standardization, or ecosystem adoption to be fully realized.
- Bold: Standardized capability manifests and egress declarations for skills (industry standards, policy)
- What: Require skills to declare intended file access, writes, and egress endpoints; marketplaces enforce least-privilege and check declarations against detonation behavior.
- Potential outputs: Skill manifest format; conformance tests; public risk labels.
- Dependencies/assumptions: Cross-vendor agreement; backward compatibility; governance for violations.
- Bold: Model-integrated taint markers and provenance (AI research, model vendors)
- What: Native LLM support for carrying and reasoning over data markers in context, enabling end-to-end provenance from sensitive read → instruction generation → action.
- Potential outputs: Taint-aware tokenizers/architectures; eval suites for provenance correctness.
- Dependencies/assumptions: Model changes and retraining; avoiding performance regressions or prompt-injection side channels.
- Bold: OS-level provenance primitives (operating systems, EDR)
- What: First-class, in-kernel information-flow tracking across processes and files (beyond inode-level heuristics), with policy hooks tailored to agent workflows.
- Potential outputs: Stable kernel APIs; policy-as-code engines; provenance query languages.
- Dependencies/assumptions: Security/performance trade-offs; upstreaming to mainline kernels; privacy implications.
- Bold: Hardware-backed detonation attestation (cloud, marketplaces, regulators)
- What: Run marketplace vetting in TEEs/microVMs and publish verifiable attestations that a given skill version passed dynamic analysis under a known policy and environment.
- Potential products: “Detonation-as-a-Service” with remote attestation; verifiable BBOM records.
- Dependencies/assumptions: TEE supply, attestation standards, reproducible harnesses.
- Bold: Continuous adversarial testing pipelines (platform security, red teams)
- What: Automate generation of evasive variants (SkillCloak-like) to continuously probe scanners and detonation policies; co-evolve defenses with feedback loops.
- Potential outputs: CI-integrated adversarial generators; policy hardening dashboards.
- Dependencies/assumptions: Safe corp governance; preventing overfitting to generators; dataset curation.
- Bold: Behavioral threat intelligence for agent ecosystems (security vendors, ISACs)
- What: Share high-level data-flow patterns (e.g., “marker from ~/.aws/credentials → POST to non-allowlisted domain → dropper exec”) rather than brittle signatures.
- Potential outputs: STIX/TAXII extensions for provenance; community detections; cross-sector playbooks.
- Dependencies/assumptions: Standard vocabularies; privacy-preserving sharing; validation criteria.
- Bold: Regulated-sector agent controls (healthcare, finance, gov)
- What: Mandate detonation, strict confidentiality policies (PHI/PII markers), and declared egress endpoints for any agent skill in regulated environments; require runtime enforcement and logs.
- Potential outputs: Sector-specific control baselines; certification programs for skills.
- Dependencies/assumptions: Mapping to HIPAA/PCI/GDPR; alignment with DLP; handling encrypted traffic.
- Bold: “Agent firewall” product category (security startups, platform vendors)
- What: A commercial, policy-driven control plane that mediates agent actions (file, tool, process, network) with detonation, provenance, and least-privilege enforcement.
- Potential features: Per-skill sandboxes, real-time prompts on sensitive operations, audit APIs.
- Dependencies/assumptions: Platform integrations (IDEs, CI, marketplaces); UX to reduce alert fatigue.
- Bold: Supply-chain attestation for agent skills (SBOM/SCITT/SLSA extensions)
- What: Extend supply-chain frameworks to cover skills: signed sources, build provenance, behavioral attestations, and reproducible packaging to reduce tampering and cloaking risk.
- Potential outputs: SCITT/OCI artifacts for skills; verifier tooling; policy gates.
- Dependencies/assumptions: Ecosystem buy-in; tooling maturity; compatibility with closed marketplaces.
- Bold: Scalable detonation orchestration (cloud providers, research)
- What: Large-scale, parallel “skill detonation farms” with environment diversity, caching, and prioritization; combine static triage with dynamic analysis to control cost.
- Potential outputs: Schedulers; coverage-guided execution (closure lift heuristics); cost models.
- Dependencies/assumptions: Cloud cost/perf; representative environment modeling; safe networking sandboxes.
- Bold: Safer agent UX patterns for consumers (daily life, education)
- What: Human-readable effect previews (“this skill would read 3 files, contact 1 new endpoint”) and consent prompts; safe-by-default modes disallowing external egress unless declared.
- Potential outputs: Design guidelines; open-source UX components; classroom labs.
- Dependencies/assumptions: Clear mental models for non-experts; localization; accessibility.
Notes on cross-cutting assumptions and constraints
- The paper’s dynamic approach presumes Linux environments with eBPF and FUSE, containerized agent runs, and configurable allowlists for sensitive files and approved egress. Porting to macOS/Windows requires alternative kernel instrumentation.
- Marker-based taint swaps real secrets with markers during detonation; some benign skills that require real credentials to proceed may exhibit altered behavior unless simulated services are provided.
- Integrity/confidentiality policies must be tuned per organization to balance false positives/negatives; regulated sectors demand stricter defaults.
- Detection efficacy can depend on agent implementations (e.g., how they load and execute skills) and on the ability to “lift” materialized instructions reliably.
- Obfuscation/evasion is an arms race; continuous red teaming and behavioral sharing help sustain effectiveness.
Glossary
- Agent Skills: Modular, shareable packages that extend an LLM agent’s capabilities when loaded. Example: "A key enabler of this transition is the emergence of Agent Skills: modular packages that allow agents such as Claude Code~\cite{anthropic2026claudecode} and OpenAI Codex~\cite{openai2026codex} to acquire new capabilities on demand."
- AST (Abstract Syntax Tree): A structured representation of source code used by static analyzers to reason about program behavior. Example: "Qualixar~\cite{scanner_qualixar} infers a skill's capabilities by AST and flags those exceeding its declared permissions,"
- eBPF: A Linux kernel facility for running sandboxed programs on kernel events (e.g., syscalls) to observe or filter behavior. Example: "inode-level reconstruction of the eBPF syscall graph recovers that same flow across opaque cross-process byte transforms."
- Faithful-execution contract: The assumption that the agent will execute the skill’s instructions as specified (e.g., following links, running scripts). Example: "under the agent's faithful-execution contract (the agent follows markdown links, runs scripts/*, and sources shell fragments as instructed)"
- FUSE: Filesystem in Userspace; a mechanism to implement filesystems at user level, enabling controlled interception of file IO. Example: "Data markers, planted at sensitive reads intercepted through a FUSE virtual filesystem, carry provenance through the agent's natural-language context;"
- Indicator of Compromise (IOC): Forensic artifacts (domains, hashes, publishers) used to identify known malicious samples. Example: "published threat-intelligence IOC lists (malicious publishers, name patterns, and file hashes from vendor campaign reports such as ClawHavoc)"
- Information-flow policies: Formal rules that constrain how sensitive data may move (e.g., confidentiality and integrity constraints). Example: "two information-flow policies, confidentiality and integrity"
- LLM-as-judge: A defense paradigm where an LLM reads a serialized bundle and issues a security verdict. Example: "LLM-as-judge instead serializes the bundle into a prompt and asks a model for a verdict,"
- Marker-Based Taint Analysis: A tainting technique that uses explicit data markers to track sensitive flows across files, processes, networks, and LLM context. Example: "marker-based taint analysis, which tracks sensitive-data flows across the agent context, files, processes, and network operations."
- On-Demand Closure Lift: A runtime mechanism that captures and executes instructions that a skill materializes during execution to expand behavioral coverage. Example: "On-Demand Closure Lift captures and executes the natural-language instructions a skill materializes at runtime, feeding them back into the agent's session."
- Payload markers: Fixed byte patterns (domains, paths, command fragments) that encode the malicious behavior and must remain reachable for the attack to fire. Example: "payload markers: a fixed set of byte markers (domains, paths, command fragments) that encode the malicious behavior and must remain reachable under the faithful-execution contract."
- Payload-preserving evasion: Transformations that alter a payload’s appearance while maintaining its malicious semantics and effects at runtime. Example: "a payload-preserving evasion framework that keeps the attack semantics intact while transforming their visible form."
- Prompt injection: An attack that injects adversarial instructions into an agent’s context to induce malicious actions. Example: "a benchmark of $150$ malicious skills that inject prompt-injection payloads into skill-enabled agents."
- Self-extracting (SFX) packing: A malware packing technique where the payload is sealed inside a stub that unpacks it at runtime. Example: "the skill-level analogue of self-extracting (SFX) packing in binary malware: a packer seals the real payload inside a self-extracting archive that unpacks at runtime,"
- Self-Extracting Skill (SFS) Packing: A skill-specific packing method that hides malicious components until runtime, when a decoder restores them for execution. Example: "Self-Extracting Skill (SFS) Packing, which hides malicious components from the install-time view and restores them during agent execution."
- Software supply-chain attack surface: The risk introduced by third-party components (e.g., skills) that execute with elevated privileges in development environments. Example: "create a software supply-chain attack surface: a malicious skill can steal credentials, exfiltrate source code, or install backdoors."
- Syscalls (system calls): Kernel-mediated calls from user processes; observing them reveals concrete runtime behavior. Example: "so the verdict is driven by the syscalls the skill actually produces."
- Taint tracking: Analysis that follows the propagation of untrusted or sensitive data through code and system interactions. Example: "tool-boundary AST taint tracking;"
- Unicode homoglyph: A visually similar character from a different script used to obfuscate tokens in text. Example: "swap a glyph for a Unicode homoglyph (any text)"
- White-box attacker: An adversary with full knowledge of the defender’s system, rules, and prompts. Example: "We assume a white-box attacker who publishes such a skill to a marketplace."
- YARA: A rule-based pattern matching language widely used to identify malware via textual and binary signatures. Example: "regex, YARA signatures, and dataflow taint"
- Zero-width codepoint: An invisible Unicode character inserted to split tokens without altering visible text, aiding evasion. Example: "Overview of the Structural Obfuscation operators (<zw>: a zero-width codepoint)."
Collections
Sign up for free to add this paper to one or more collections.