cs.CRSep 30, 2026

ActionGuard: Tool Call Authorization under Poisoned Skills

Authors: Jihun Han, Yejin Jang, Byung Il Kwak, Mee Lan Han

Organizations: Korea University Republic of Korea

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

LLM-based agents extend their capabilities through third-party skills that provide task-specific instructions, scripts, and tool-use procedures. However, malicious instructions inserted into an otherwise benign skill can cause a benign user request to trigger dangerous Tool Calls, including data exfiltration, file deletion, or unauthorized code execution. This paper presents ActionGuard, which inspects skill-influenced Tool Calls immediately before execution. ActionGuard separates the target agent's action-generation context from the safeguard's authorization context. The target agent may use the original skill for planning, but the Reviewer does not receive the potentially poisoned raw skill text. Instead, it determines whether each action is justified by the trusted user request using a balanced skill profile, current and recent Tool Calls, and local script contents. ActionGuard intercepts each Tool Call at OpenClaw's before-tool-call stage and enforces the Reviewer's ALLOW or DENY decision under a fail-closed policy. We evaluate ActionGuard on 139 contextual and 180 obvious injections in a SKILL-INJECT-based setting against Dynamic Guardian and SkillGuard, using three open-source and two commercial Reviewer models. Each condition is repeated three times and evaluated using Attack Success Rate (ASR) and Task Success Rate (TSR). Overall, ActionGuard reduced ASR by 35.54 to 46.11 percent relative to existing safeguards and by 70.44 percent relative to No Safeguard, while maintaining high benign-task completion. These results show that execution-boundary authorization grounded in trusted user intent and runtime evidence can restrict unauthorized Tool Calls induced by skill injection.

Figures & tables

Figure 1. Effect of Benign and Poisoned Skills on Agent Behavior.
Figure 2. Overview of the Runtime Authorization Workflow in ActionGuard.
Figure 3. Workflow for Resolving and Constructing Balanced Skill Profiles.
FieldDescription
DecisionAn ALLOW or DENY verdict that indicates whether the current Tool Call may execute.
ReasonAn explanation of the main evidence used in the decision and the basis for authorization or blocking.
Reason CodeA normalized category for consistent analysis of the decision rationale.
Table 1. Output Schema of the Semantic Reviewer.
TypeModelModel Identifier
Open SourceGemma 4gemma4:e4b-it-q4_K_M
 Qwen 3.5qwen3.5:9b
 Ministral 3ministral-3:8b-instruct-2512-q4_K_M
CommercialGPT-5.4 minigpt-5.4-mini-2026-03-17
 Claude Haikuclaude-haiku-4-5-20251001
Table 2. Reviewer Models Used for Evaluation.
 Gemma 4Qwen 3.5Ministral 3GPT-5.4 miniClaude Haiku
DefenseASR ↓\downarrowTSR ↑\uparrowASR ↓\downarrowTSR ↑\uparrowASR ↓\downarrowTSR ↑\uparrowASR ↓\downarrowTSR ↑\uparrowASR ↓\downarrowTSR ↑\uparrow
Contextual
Dynamic Guardian ( Fujinuma et al., 2026 )14.39%86.67%12.71%88.67%7.19%87.67%20.62%89.00%19.66%89.33%
SkillGuard ( Pan et al., 2026 )22.06%90.00%19.18%89.67%18.71%88.33%18.94%89.00%20.14%88.67%
ActionGuard8.87%87.33%8.63%86.00%8.87%90.67%7.67%89.67%6.95%85.00%
Obvious
Table 3. Safeguard Performance Across Contextual and Obvious Injection Types, Averaged over Three Runs
MethodASR (%) ↓\downarrowTSR (%) ↑\uparrow
Dynamic Guardian ( Fujinuma et al., 2026 )16.0592.08
SkillGuard ( Pan et al., 2026 )13.4288.55
ActionGuard8.6590.38
No Safeguard29.0593.46
Table 4. Overall Performance Comparison of Safeguards in Terms of Attack Success Rate (ASR) and Task Success Rate (TSR): averaged across all reviewer models and injection types.
Figure 4. Safeguard Performance Across Injection Types: (a) Attack Success Rate (ASR) comparison of Dynamic Guardian, SkillGuard, and ActionGuard under contextual and obvious injection attacks; (b) Task Success Rate (TSR) comparison under the same injection settings.
Figure 5. Safeguard Performance Across Reviewer Models: (a) Attack Success Rate (ASR) comparison of Dynamic Guardian, SkillGuard, and ActionGuard using open source and commercial Reviewer models; (b) Task Success Rate (TSR) comparison under the same Reviewer model settings.
ItemConfiguration
Host operating systemWindows 11 Pro, version 10.0.26200 (build 26200)
Processor and memoryIntel Core i7-13700F; 16 physical cores, 24 logical processors, and 63.8 GiB host memory
GPUNVIDIA GeForce RTX 4070 Ti SUPER; 16,376 MiB VRAM; driver 591.86
Container engineDocker Desktop / Docker Engine 27.3.1
Task imageinstruct-bench-agent , derived from python:3.11-slim
In-container environmentDebian GNU/Linux 13, Python 3.11.16, Node.js 24.19.0, OpenClaw 2026.5.28 (commit e932160 ), and Codex CLI 0.147.0
Table 5. Experimental host and sandbox environment.
Appendix figures & tables1 asset

Supplementary material from the paper’s appendix.

Appendix

ParameterSetting
Interception pointOpenClaw before_tool_call hook
Profile-database scopeEmpty at task start; reused across subsequent Tool Calls in the same sandbox
Skill-package snapshotAt most 32 text files and 100,000 source characters
Path handlingSymbolic links skipped; resolved paths restricted to the configured Skill root
Package identitySHA-256 digest over collected relative paths and source content
Maximum profile entries40 entries per profile field
Appendix
Table 6. Implementation-specific ActionGuard parameters.

Explore similar work

CardsList
Jul 23, 2026cs.CR

ToolGuardian: Declarative Security for AI Agent-Tool Interactions

LLM agents increasingly rely on external tools, expanding capability while creating a new security boundary: third-party tools may appear benign at the interface level while embedding unsafe behavior in implementation. Existing defenses rely on weak metadata, collapse characterization and policy judgment into a single decision, or use heuristic/LLM enforcement that lacks deterministic, auditable reasoning over task context and multi-tool composition. This paper presents ToolGuardian, a policy-driven framework for securing agent-tool interactions through pre-admission vetting and task-aware runtime authorization. ToolGuardian uses progressive characterization to convert evidence into structured facts: descriptions capture declared intent, system-call traces expose coarse behavior, mock execution reveals observed effects, and source analysis identifies latent behavior. ToolGuardian's core contribution is an Answer Set Programming (ASP)-based declarative policy layer that reasons explicitly over capabilities, effects, task context, and composition. We compare ASP against heuristic and LLM-based policy realizations using identical inputs and output contracts. We evaluate ToolGuardian on 16 MCP-style tools, including 8 malicious variants derived from real open-source tools, and 20 runtime scenarios. For vetting, ASP reaches a deny-class F1 of 0.86 and 88% accuracy using description, syscall, and observed-effect evidence. For runtime authorization, fully specified realizations classify all scenarios correctly, while ablations show that removing compositional and conformance rules substantially degrades performance.

Arun Ravindran, Saurabh Deochake

Department of Electrical and Computer Engineering University of North Carolina at Charlotte Charlotte, NC · SentinelOne Mountain View, CA

AuthorizationAgentic DeploymentsLarge Language Model Policy Optimization
AskPDF
May 27, 2026cs.CR

AIRGuard: Guarding Agent Actions with Runtime Authority Control

Tool-using language agents turn model decisions into external side effects: they read files, run scripts, call APIs, send messages, and invoke Model Context Protocol tools. This makes agent attacks different from jailbreaks. The harmful step is often not an obviously forbidden output, but an ordinary executable action that becomes unsafe because attacker-controlled context steers authorized access against the user's interest. We identify this failure mode as authority confusion: untrusted resources may inform reasoning, but they must not authorize side effects. We present AIRGuard, a runtime guard that operationalizes least privilege as action-time authorization. AIRGuard normalizes heterogeneous tool calls, derives task authority into step-level authority, tracks source and target trust, simulates sensitive side effects, audits cross-step risk, and enforces decisions before actions execute. On AgentTrap, AIRGuard reduces Sonnet 4.6 attack success from 36.3% without defense to 5.5%. On DTAP-150, AIRGuard preserves 76.0% benign utility with Haiku 4.5, compared with 52.0% for ARGUS and 42.0% for MELON. An ablation further shows that prompt-only policy helps only modestly, whereas a dedicated runtime authority-control layer gives the agent system direct control over tool-mediated side effects. Code and data are available at https://github.com/Sophie508/AIRGuard.

Suliu Qin, Haomin Zhuang, Yujun Zhou +2

University of Liverpool · University of Notre Dame · 2Inria, France

AuthorizationRuntime Safety FilteringDiverse AttacksRuntimeAction Expert
AskPDF
Sep 29, 2026cs.CR

ToolFence: Fine-Grained Authorization for Secure Tool-Using LLM Agents

Tool-using LLM agents remain vulnerable to indirect prompt injection because trusted instructions and untrusted observations share one context, allowing malicious content to steer consequential input-filtering defenses. Multi-path consensus defenses still leave a high attack success rate because they examine content or aggregated outputs rather than authorizing effects, especially for the within-tool attack, which preserves the intended tool but manipulates its arguments. Data-Flow Control such as CaMeL provides stronger guarantees, but incurs substantial time latency that limits practical deployment. We introduce ToolFence, which compiles a typed authorization blueprint before execution, enforces it through a deterministic monitor, and when the blueprint is incomplete asks a judge to grant new capabilities rather than adjudicate each concrete call. ToolFence provides two key advantages. First, its fine-grained provenance-aware authorization enables the system to distinguish user-authorized values from untrusted observations, effectively addressing the within-tool attack. Second, its deterministic fast path and capability-level runtime grants substantially reduce the frequency of expensive judge calls, improving runtime efficiency. On AgentDojo with Qwen3-max, ToolFence reduces overall ASR to near zero with only a 3.80 percentage-point clean-utility drop and practical runtime overhead.

Yanjie Li, Xiangyu He, Xuelong Dai +1

Hong Kong Polytechnic University · Shandong University

AuthorizationLanguage-Model AgentsLarge Language Model AgentsModel-Agnostic Defense
AskPDF