Lifecycle poisoning of reusable agent skills

Description

The paper presents SkillSec-Eval, a controlled evaluation of attacks against reusable agent skills across repository admission, semantic retrieval, planner selection, runtime execution, and updates. It reports that malicious metadata, retrieval manipulation, unsafe workflow composition, and poisoned updates can cause agents to retrieve, select, or execute unintended skills. These are paper-reported benchmark results, not independently verified vulnerabilities in a named production product.

Examples

See the primary source for the paper's evaluation and defensive reproduction context: https://arxiv.org/abs/2607.13987

Impact

In the evaluated baseline configurations, malicious skills could enter repositories, dominate retrieval results, influence planner choices, invoke unauthorized tools, move sensitive data to privileged sinks, or inherit trust through updates. The paper reports 93.20% retrieval ASR for a 15-clone Sybil attack, 45.64% planner ASR for fake recommendations, 100% execution ASR without runtime monitoring, and 100% malicious-update acceptance without continuous validation.

Affected Systems

• Reusable agent skill repositories and marketplaces
• Semantic skill retrieval pipelines
• LLM agent planners
• Agent skill execution runtimes
• Agent skill update pipelines
• SkillSec-Eval
• FAISS FlatL2
• LifecycleGuard

Mitigation Steps

• Require signatures, payload integrity checks, provenance verification, dependency validation, and version-lineage checks before admitting skills.
• Validate semantic consistency among skill descriptions, executable workflows, and requested permissions; reject hidden instructions and unjustified privileges.
• Use trust-aware retrieval with duplicate filtering, metadata consistency checks, permission consistency checks, and reputation-aware reranking.
• Sanitize planner-visible metadata, remove fabricated trust claims and injection patterns, and validate capabilities before skill selection.
• Enforce least privilege in a sandboxed runtime, mediate every tool invocation, block untrusted sinks, and track sensitive information flow.
• Treat every skill update as a new admission event; review permission, dependency, provenance, and behavioral changes before preserving trust.
• For defensive reproduction, use synthetic skills, mock tools, inert sensitive data, and isolated network sinks; measure the paper’s MAR, retrieval ASR, planner ASR, and execution ASR without executing real malicious artifacts.

Evidence

• https://arxiv.org/abs/2607.13987 and Sections 3–4 describe a lifecycle threat model covering admission, retrieval, selection, execution, and evolution of reusable agent skills.
• Section 5.1 reports a controlled repository of 327 benign SkillMCP-derived skills across 15 capability clusters; Section 5.3 reports 440 benchmark queries, all-MiniLM-L6-v2 embeddings, FAISS FlatL2 retrieval, and Top-5 planner candidates.
• Section 6.1, Table 2 reports malicious admission rates of 52.9% for rules only, 42.9% for semantic only, and 7.9% for the hybrid defense, with a 20.0% false-positive rate for semantic and hybrid validation.
• Section 6.2, Table 3 reports baseline retrieval ASRs of 46.59% for keyword stuffing, 61.14% for semantic camouflage, 31.82% for trigger poisoning, and 93.20% for a 15-clone Sybil attack; defended ASRs remain 7.83%, 9.82%, 17.50%, and 26.59%, respectively.
• Section 6.3, Table 4 reports planner ASRs of 45.64% for fake recommendations and 27.27% for misleading descriptions, reduced to 8.72% and 0.00% by metadata validation. Section 5.3 names Gemini 3.1 pro, while Section 6.3 names Gemini 1.5 Flash, an internal model-name inconsistency in the paper.
• Section 6.4, Table 5 reports 100.0% execution ASR without monitoring and 23.0% with LifecycleGuard; the proposed defense reports 87.0% policy blocking and 66.67% taint accuracy.
• Section 6.5, Table 6 reports that unmoderated evolution accepts 100% of malicious updates; continuous validation reports 92.5% malicious detection, 7.5% false negatives, and 37.0% false positives.
• Section 7 explicitly limits the findings to a controlled evaluation environment rather than a production deployment and excludes attacks on the underlying LLM itself.
• Appendix B provides the LLM-component prompt templates and states that experiments use deterministic decoding at temperature 0. The arXiv landing page directly links the PDF, experimental HTML, and TeX source, but does not list an author-supplied code or dataset artifact.