cs.CRApr 3, 2026

Towards Secure Agent Skills: Architecture, Threat Taxonomy, and Security Analysis

Authors: Zhiyuan Li, Jingzheng Wu, Xiang Ling, Xing Cui, Tianyue Luo

Organizations: Institute of Software, Chinese Academy of Sciences, Beijing, China · University of Chinese Academy of Sciences, Beijing, China · Key Laboratory of System Software (Chinese Academy of Sciences), Beijing, China

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

Agent Skills is an emerging open standard that defines a modular, filesystem-based packaging format enabling LLM-based agents to acquire domain-specific expertise on demand. Despite rapid adoption across multiple agentic platforms and the emergence of large community marketplaces, the security properties of Agent Skills have not been systematically studied. This paper presents a systematization of the security of the Agent Skills framework. We define a threat model for the framework and decompose the full lifecycle of an Agent Skill across four phases---Creation, Distribution, Deployment, and Execution---identifying the structural attack surface each phase introduces. Building on this lifecycle analysis, we construct a threat taxonomy comprising seven categories and nineteen scenarios organized across three attack layers, grounded in both architectural analysis and real-world evidence. Each scenario is annotated with whether the exposure follows from the specification or from the latitude the specification leaves to individual runtimes, with the strength of the public evidence supporting it, and with the feasibility of its mitigation. We map seven documented security incidents onto the taxonomy. Based on these findings, we discuss defense directions for each threat category, identify open research challenges, and provide actionable recommendations for stakeholders. The most severe threats arise from structural properties of the framework itself: the absence of a data-instruction boundary, a single-approval persistent trust model, and a capability declaration mechanism to which the specification attaches no enforcement semantics. None of these is addressable through incremental mitigations alone.

Figures & tables

DimensionDescriptionChatGPT PluginsMCPAgent Skills
Specification-Determined Properties
Instruction CarrierFormat used to convey the capability specification to the agent✔▲✘
Data/Instruction BoundaryWhether instructions and runtime data are structurally separated✔▲✘✘
Capability DeclarationWhether a capability must declare the resources it accesses, and whether that declaration binds✔▲✘
Trust ModelGranularity and persistence of the authority granted when a capability is enabled✔✘✘✘
Implementation-Determined Properties
Table 1. Comparison of agent capability extension mechanisms across security-relevant dimensions.
Table 2. Representative structure of a SKILL.md file.
Figure 1. The Agent Skills architecture. Left: the filesystem layout of a Skill package within the agent’s virtual machine, comprising SKILL.md , supplementary instruction files, and executable scripts. Right: the three-level progressive disclosure process, showing how Skill metadata ( mim_{i} ), instructions ( insti\mathit{inst}_{i} ), and supplementary files ( fi,jf_{i,j} ) are loaded into the context window incrementally across Levels 1, 2, and 3 . The Agent Skills architecture. Left: the filesystem layout of a Skill package within the agent's virtual machine, comprising SKILL.md, supplementary instruction files, and executable scripts. Right: the three-level progressive disclosure process, showing how Skill metadata (mim_i), instructions (insti\mathit{inst}_i), and supplementary files (fi,jf_{i,j}) are loaded into the context window incrementally across Levels 1, 2, and 3.
Figure 2. The Agent Skills lifecycle and threat taxonomy. The horizontal axis represents the four lifecycle phases. The vertical axis organizes threats into three attack layers. Scenarios that Table 3 maps to two phases are placed here at the earlier of the two, the phase in which they originate. Empty cells indicate that no threat in that layer originates at that phase. The Agent Skills lifecycle and threat taxonomy. The horizontal axis represents the four lifecycle phases. The vertical axis organizes threats into three attack layers. Scenarios that Table~\ref{tab:taxonomy} maps to two phases are placed here at the earlier of the two, the phase in which they originate. Empty cells indicate that no threat in that layer originates at that phase.
IDScenarioDescriptionPhOrEvFe
Layer 1: Delivery and Trust Establishment
T1: Supply Chain Compromise
T1.1TyposquattingMalicious Skill registered under a name resembling a popular legitimate Skill to deceive users into installationDiEcMI
T1.2Ranking ManipulationAttacker inflates download counts and ratings to position a malicious Skill above legitimate alternativesDiEcMI
T1.3Repository HijackingAttacker gains control of a legitimate Skill repository through account takeoverDiEcDI
T1.4Hallucinated PackageSkill references packages that do not exist, which attackers later claim on public registries to achieve code executionCr/DiEcDI
Table 3. Threat taxonomy for Agent Skills. Ph gives the lifecycle phase of origin: Cr = Creation, Di = Distribution, De = Deployment, Ex = Execution. Or gives the origin of the exposure: Sp = specification, Im = implementation latitude, Ec = ecosystem distribution. Ev gives the strength of the public evidence: M = multiple independent measurements or campaigns, D = a single documented incident or demonstration, A = architectural inference with no public instance. Fe gives the mitigation feasibility: I = incremental, deployable without specification change, S = requires a specification change, O = open problem.
IncidentMappingKey Impact
MedusaLocker SkillT4.1, T2.1Ransomware executed via bundled script, consent gap exploited
ClawHavoc CampaignT1.1, T1.2, T5.1At least 1,184 malicious Skills, credential theft at ecosystem scale
CVE-2025-59536 / CVE-2026-21852T6.2, T5.1Command execution and API key exfiltration via configuration injection
SafeDep PEP 723T4.2Deferred dependency attack via unpinned script dependencies
Mitiga Silent EgressT5.3, T1.2Project codebase exfiltrated in four user interactions, audit log empty
Zenity Skill Supply ChainT1.1, T1.2, T1.5, T5.11.7 million installations, developer and CI credentials harvested, copies persisted after takedown
Table 4. Documented Agent Skills security incidents and their taxonomy mappings.
Figure 3. The MedusaLocker Ransomware attack. The user-visible layer shows normal GIF creation behavior, while the invisible execution layer downloads and executes MedusaLocker ransomware through the bundled helper script. The MedusaLocker Ransomware attack. The user-visible layer shows normal GIF creation behavior, while the invisible execution layer downloads and executes MedusaLocker ransomware through the bundled helper script.
DimensionHou et al. (MCP) ( Hou et al., 2025 )Xu and Yan ( Xu and Yan, 2026 )OWASP Skills ( OWASP GenAI Security Project, 2026 )Ours
Threat Categories
T1 Supply chain compromise⚫⚫⚫⚫
T2 Consent abuse◗◗◗⚫
T3 Prompt injection⚫⚫⚫⚫
T4 Code execution◗⚫⚫⚫
T5 Data exfiltration⚫⚫⚫⚫
Table 5. Coverage of our threat categories by the closest prior and concurrent systematizations. ⚫ treated as a distinct category with an identified cause; ◗ mentioned or covered in part; ❍ not addressed.
Appendix figures & tables3 assets

Supplementary material from the paper’s appendix.

Appendix

MechanismLevelBasis
Instruction Carrier
ChatGPT Plugins✔The capability is conveyed as an OpenAPI manifest. The document is machine-parseable and enumerates endpoints with typed parameters, so an author cannot express behavioral directives outside the schema ( OpenAI, 2023 ) .
MCP▲Tools, resources, and prompts are declared with structured schemas, but the human-readable description fields accompanying each tool are model-facing prose and are read by the model when selecting operations ( Hou et al., 2025 ) .
Agent Skills✘The instructions body of SKILL.md is unstructured Markdown interpreted directly by the model. The specification imposes no schema on its content ( Agent Skills, 2025 ; Anthropic, 2025a ) .
Data/Instruction Boundary
ChatGPT Plugins✔The manifest and the API response are distinct artifacts. Response payloads return to the model within a typed envelope and cannot alter the set of operations the model may invoke ( OpenAI, 2023 ) .
Appendix
Table 6. Per-cell evidence for specification-determined properties.
MechanismLevelBasis
Execution Locus
ChatGPT Plugins✔Execution occurs on the provider’s infrastructure. No plugin code runs on the user’s machine ( OpenAI, 2023 ) .
MCP▲ – ✘Servers may be reached over HTTP, in which case execution is remote, or launched over stdio, in which case the server runs as a local user process ( Hou et al., 2025 ) .
Agent Skills▲ – ✘Skills execute within a managed environment on the Claude API and on the user’s host under Claude Code ( Pluto Security, 2026 ) .
Runtime Isolation
ChatGPT Plugins✔Isolation follows from the execution locus. The user’s machine is not a target of plugin code ( OpenAI, 2023 ) .
Appendix
Table 7. Per-cell evidence for implementation-determined properties.
MechanismLevelBasis
Marketplace Review
ChatGPT Plugins✔Publication in the plugin store required passing a review process combining automated and human checks ( CustomGPT, 2023 ) .
MCP✘Distribution is decentralized. Servers are installed directly from source repositories, and no review gate stands between publication and installation ( Hou et al., 2025 ) .
Agent Skills✘The major community marketplaces impose no mandatory review before publication ( Snyk Security Research, 2026 ) . Curated registries that scan and sign Skills have since appeared ( NVIDIA, 2026 ) , but they are additional channels rather than a requirement of the ecosystem.
Appendix
Table 8. Per-cell evidence for distribution and ecosystem governance.
More in this topic

LLM Agent Security

Large language model agent security studies attacks and safeguards for systems that plan, use tools, retain memory, and act across applications.

See all 327 papers

Explore similar work

CardsList
Mar 17, 2026

Context Matters: Repository-Aware Security Analysis of the Agent Skill Ecosystem

Agent skills extend local AI agents, such as Claude Code and OpenClaw, with additional functionality. Their growing popularity has led to dedicated marketplaces resembling mobile app stores, as well as automated scanners that assess whether skills are benign or malicious. However, scanner reports from individual marketplaces classify up to 46.8% of skills as malicious, raising concerns about false positives. We present the largest empirical security analysis of the AI agent skill ecosystem to date. We collect 238,180 unique skills from three major distribution platforms and GitHub, and analyze their contents, behavior, and repository context. Unlike existing scanner-based assessments, which evaluate skills largely in isolation, our repository-aware analysis checks whether a flagged skill is consistent with its surrounding GitHub project. This context substantially reduces the number of suspicious skills: only 0.52% remain suspicious after repository-aware analysis. Our results show that existing scanners can substantially overestimate maliciousness when repository context is ignored. At the same time, we identify previously undocumented real-world attack vectors, including the hijacking of skills hosted in abandoned GitHub repositories. Overall, our findings provide a more robust view of the agent-skill ecosystem's current risk surface and highlight the need for context-aware security evaluation.

Florian Holzbauer, David Schmidt, Gabriel Gegenhuber +2

Interdisciplinary Transformation University (IT:U), Linz, Austria · University of Vienna, CDL AsTra, Faculty of Computer Science, Vienna, Austria

AI Agent SecurityAgent Skill Security AuditingSoftware Supply Chain Security
AskPDF
Feb 24, 2026

SoK: Agentic Skills -- Beyond Tool Use in LLM Agents

Agentic systems increasingly rely on reusable procedural capabilities, a.k.a., agentic skills, to execute long-horizon workflows reliably. These capabilities are callable modules that package procedural knowledge with explicit applicability conditions, execution policies, termination criteria, and reusable interfaces. Unlike one-off plans or atomic tool calls, skills operate (and often do well) across tasks. This paper maps the skill layer across the full lifecycle (discovery, practice, distillation, storage, composition, evaluation, and update) and introduces two complementary taxonomies. The first is a system-level set of seven design patterns capturing how skills are packaged and executed in practice, from metadata-driven progressive disclosure and executable code skills to self-evolving libraries and marketplace distribution. The second is an orthogonal \textbf{representation ×\times scope} taxonomy describing what skills are (natural language, code, policy, hybrid) and what environments they operate over (web, OS, software engineering, robotics). We analyze the security and governance implications of skill-based agents, covering supply-chain risks, prompt injection via skill payloads, and trust-tiered execution, grounded by a case study of the ClawHavoc campaign in which nearly 1{,}200 malicious skills infiltrated a major agent marketplace, exfiltrating API keys, cryptocurrency wallets, and browser credentials at scale. We further survey deterministic evaluation approaches, anchored by recent benchmark evidence that curated skills can substantially improve agent success rates while self-generated skills may degrade them. We conclude with open challenges toward robust, verifiable, and certifiable skills for real-world autonomous agents.

Yanna Jiang, Delong Li, Haiyu Deng +4

University of Technology Sydney · CSIRO Data61

Agentic AILLM Agent Skill LearningLLM Agent Security
AskPDF
Jun 13, 2026

Benign in Isolation, Harmful in Composition: Security Risks in Agent Skill Ecosystems

Skills are becoming the capability layer through which LLM agents turn plans into actions, but their use introduces security risks such as data leakage, unauthorized operations, and tool misuse. Existing vetting usually evaluates each skill in isolation, while real agent tasks often invoke multiple skills in a shared execution context. This creates Skill Composition Risk (SCR): a skill that appears benign alone can become harmful when its outputs, trust signals, authorization cues, or side effects influence later invocations along an activated path. We introduce SCR-Bench to evaluate this risk in controlled, sandboxed skill environments. Rather than relying only on textual intent or surface behavior, SCR-Bench records downstream state changes and path-level outcomes across composed skill executions. It contains three sub-benchmarks: SCR-CapFlow for capability-flow composition, SCR-TrustLift for trust-transfer composition, and SCR-AuthBlur for authorization-confusion composition. Across SCR-Bench, composed paths expose risks that are largely absent under isolated evaluation. In SCR-CapFlow, attack success rate reaches 33.6 percent under composition, compared with near-zero isolated baselines. In SCR-TrustLift, attack success rate exceeds 96.5 percent on four of five backends. In SCR-AuthBlur, the risky-approval rate increases by 71.8 percent relative to the L0 isolated baseline under the L1 context setting. These results show that agent skill security should be assessed at the level of activated paths rather than isolated artifacts. SCR and SCR-Bench provide a foundation for path-aware risk evaluation and defense in LLM agent skill ecosystems. Benchmark: https://github.com/saint-viperx/SCR_Bench.

Yi Xie, Jiawei Du, Yu Cheng +2

East China Normal University, Shanghai, China · Centre for Frontier AI Research A*STAR, Singapore · Shanghai Innovation Institute, Shanghai, China

LLM Agent SecurityAI Agent Security BenchmarksAgent Skill Security Auditing
AskPDF