Source-linked AI summary
Towards Secure Agent Skills: Architecture, Threat Taxonomy, and Security Analysis
Zhiyuan Li, Jingzheng Wu, Xiang Ling, Xing Cui, Tianyue Luo
TL;DR
Agent Skills enable modular, filesystem-based capability extension, but their security properties have not been systematically studied despite rapid adoption. This paper analyzes the framework across its lifecycle, constructs and validates a threat taxonomy, and finds that its most severe risks arise from structural design properties requiring architectural reform.
Problem
Agent Skills have rapidly adopted natural-language instructions, local execution, and open distribution without a systematic security analysis of their structural risks.
Method
The paper analyzes four lifecycle phases, constructs a taxonomy of seven categories and seventeen scenarios, and examines real-world incidents and defense directions.
Results
The analysis identifies seven threat categories across three attack layers, including prompt injection, code execution, data exfiltration, consent abuse, supply-chain compromise, persistence, and multi-agent propagation.
Takeaways & Limitations
The most severe threats arise from the absent data-instruction boundary, persistent single-approval trust model, and lack of mandatory marketplace review, requiring architectural reform.
Takeaways & Limitations
Reliable behavioral analysis remains difficult because no formal specification currently defines a Skill’s intended natural-language behavior.
Abstract
from arXiv · showhide
Agent Skills is an emerging open standard that defines a modular, filesystem-based packaging format enabling LLM-based agents to acquire domain-specific expertise on demand. Despite rapid adoption across multiple agentic platforms and the emergence of large community marketplaces, the security properties of Agent Skills have not been systematically studied. This paper presents the first comprehensive security analysis of the Agent Skills framework. We define the full lifecycle of an Agent Skill across four phases -- Creation, Distribution, Deployment, and Execution -- and identify the structural attack surface each phase introduces. Building on this lifecycle analysis, we construct a threat taxonomy comprising seven categories and seventeen scenarios organized across three attack layers, grounded in both architectural analysis and real-world evidence. We validate the taxonomy through analysis of five confirmed security incidents in the Agent Skills ecosystem. Based on these findings, we discuss defense directions for each threat category, identify open research challenges, and provide actionable recommendations for stakeholders. Our analysis reveals that the most severe threats arise from structural properties of the framework itself, including the absence of a data-instruction boundary, a single-approval persistent trust model, and the lack of mandatory marketplace security review, and cannot be addressed through incremental mitigations alone.
1 Introduction
Agent Skills emerged as a filesystem-based capability-extension framework whose rapid adoption has outpaced security analysis. This paper examines its lifecycle attack surface, threat taxonomy, incidents, defenses, and research challenges.
- Agent Skills package natural-language instructions, executable scripts, and resources so agents can acquire domain expertise without retraining.
- Rapid adoption has exposed structural risks involving persistent permissions, open distribution, local code execution, and natural-language instruction delivery.
- The paper decomposes the framework into Creation, Distribution, Deployment, and Execution phases to identify security implications across its full lifecycle.
- The threat taxonomy identifies 7 categories and 17 scenarios across three attack layers, grounded in architectural analysis and real-world evidence.
- The study analyzes five real-world incidents, discusses mitigations and open challenges, and provides recommendations for improving Agent Skills security.
2 Background
Agent Skills extend earlier plugin and protocol approaches by replacing typed interfaces with natural-language, filesystem-based packages. This increases expressive flexibility and authorship accessibility while weakening boundaries around execution, permissions, and distribution.
- ChatGPT Plugins expose typed OpenAPI manifests and use remote, operator-controlled endpoints to access live data and external services.
- MCP standardizes tool integration through JSON-RPC and structured schemas, reducing integration overhead while preserving a partial data-to-instruction boundary.
- The comparison framework evaluates execution locus, permission scope, and distribution governance, including whether mandatory marketplace vetting exists.
- Agent Skills replace typed schemas with natural-language SKILL.md files, enabling complex workflows, organizational context, and broader authorship.
- Agent Skills co-locate instructions and executable scripts, permit local user-privilege execution, and grant persistent operator-level authority after one approval.
3 The Architecture of Agent Skills
Agent Skills are self-contained filesystem packages whose natural-language instructions can invoke files, scripts, and network resources. Progressive disclosure loads content incrementally, while installation creates persistent operator-level authority with a consent gap.
- 3.1 Package Structure: Each Skill requires SKILL.md and may include executable scripts, reference assets, and supplementary instruction files.
- 3.1 Package Structure: SKILL.md contains frontmatter metadata and an unstructured instruction body that can direct file access, script execution, and network activity.
- 3.1 Package Structure: The package lacks a formal contract linking its declared description to its instructions and lacks a structural separation between instructions and runtime data.
- 3.2 Progressive Disclosure Loading Model: Progressive disclosure loads metadata for all Skills first, retrieves relevant instructions at Level 2, and loads supplementary files or executes scripts at Level 3.
- 3.3 Trust Model and Permission Scope: Installed and activated Skills receive operator-level authority, and a single approval grants persistent, undifferentiated permissions without per-action or per-session confirmation.
- 3.3 Trust Model and Permission Scope: The trust relationship remains attached to Skill identity rather than cryptographically committed content, so post-installation instruction changes inherit the original approval.
4 Agent Skills Lifecycle and Attack Surface
Agent Skills move through four sequential phases—Creation, Distribution, Deployment, and Execution—and each phase introduces distinct structural attack surfaces. These surfaces can interact across phases, allowing attacks introduced during distribution to manifest during execution while deployment consent obscures the mismatch.
- Lifecycle phases: The lifecycle comprises Creation, Distribution, Deployment, and Execution, from authorship through runtime activation.Skills are authored with instructions and scripts, published for installation, granted authority during deployment, and activated at runtime.
- Creation: Creation permits authors to combine benign-looking descriptions with adversarial operator-level instructions and executable scripts.Natural-language instructions cannot be fully characterized by static analysis, leaving behavioral scope difficult to verify.
- Distribution: Distribution lacks mandatory security review, enabling malicious Skills to reach users through deceptive descriptions and marketplace selection mechanisms.Post-publication modification further compounds the risk because installed trust remains tied to Skill identity rather than content version.
- Deployment: Deployment grants persistent, undifferentiated operator-level authority based on installation-time information, so later actions can exceed the user’s understood authorization.The granted permission scope is not constrained by subsequent content changes or by what the user scrutinized during installation.
- Execution: Execution exposes prompt-injection and runtime-abuse surfaces because Skill instructions receive operator-level authority and bundled script source remains invisible to the agent.Supplementary content and script outputs can extend the injection surface, while scripts may perform filesystem or network operations the agent cannot inspect beforehand.
- Cross-phase attack surface: Threats may span phases, such as distribution compromise becoming execution-time prompt injection while deployment consent prevents recognition of unauthorized authority.The taxonomy therefore organizes threats by primary origin while acknowledging cross-phase attack paths.
5 Threat Taxonomy
The taxonomy organizes Agent Skills threats into seven categories across three attack layers, covering delivery and authority acquisition, direct runtime attacks, and effects that extend beyond a session or agent. Its scenarios include marketplace deception, persistent consent abuse, instruction injection, code execution, and credential or secret theft.
- Taxonomy structure: Seven threat categories span three layers: supply chain compromise and consent abuse; direct attacks; and persistence or multi-agent propagation.The layers distinguish how malicious Skills acquire authority, what activated Skills directly do, and how compromise extends beyond the current session or agent.
- T1: Supply Chain Compromise: Typosquatting, ranking manipulation, repository hijacking, and hallucinated packages exploit marketplace selection, reputation, trusted repositories, or AI-generated dependencies.These supply-chain scenarios can make malicious Skills appear legitimate or cause harmful packages to be installed during execution.
- T2: Consent Abuse: Consent abuse grants persistent operator-level authority from one installation event, while post-installation modification can inherit approval without re-authorization.The consent gap separates the user’s understanding at installation from the unconstrained authority later exercised by the Skill.
- T3: Prompt Injection: Direct injection embeds adversarial instructions in SKILL.md, whereas indirect injection imports them through external content interpreted alongside operator-level instructions.Direct injection appeared in 26.1% of 42,447 analyzed Skills, while indirect injection exploits retrieved content that lacks a structural data-instruction distinction.
- T4: Code Execution: Malicious scripts, deferred dependencies, and remote code fetches let Skills execute attacker-controlled code that installation-time review may not reveal.The ClawHavoc campaign involved more than 1,184 compromised Skills, while remote fetching can deliver payloads directly at runtime.
- T5: Data Exfiltration: Credential and environment-variable harvesting target filesystem secrets and deployment-injected credentials, including API keys, private keys, passwords, and wallet data.Environment variables aggregate secrets from multiple services in a programmatically accessible runtime location.
6 Real-World Incidents
Five real-world incidents validate the Agent Skills threat taxonomy across malicious Skills, marketplace supply chains, configuration persistence, deferred dependencies, and silent data exfiltration. Together, the incidents show that these attacks exploit structural properties of the framework rather than isolated implementation errors.
- MedusaLocker ransomware: A weaponized GIF converter silently downloaded and executed MedusaLocker ransomware through a bundled script, encrypting the user’s filesystem while returning benign output.The incident exploited the co-location of natural-language instructions and executable scripts, keeping the ransomware outside the agent’s reasoning process.
- ClawHavoc campaign: ClawHavoc compromised over 1,184 Skills—approximately one in five packages—using typosquatting and manipulated marketplace rankings to distribute infostealers and harvest credentials.The campaign exploited the absence of mandatory marketplace security review and the trust users place in popularity signals.
- Configuration injection: Claude Code vulnerabilities showed that malicious repository configurations could execute arbitrary shell commands before trust dialogs and exfiltrate API keys.The flaws mapped to config injection because configuration files persist across sessions and affect subsequent operations.
- Deferred dependencies: Deferred dependencies extend the attack window because runtime code is not determined at installation, allowing malicious content to evade installation-time static analysis.The paper identifies dependency pinning, reproducible builds, and runtime integrity verification as necessary but currently unenforced safeguards.
- Silent exfiltration: Progressive disclosure lets Skills read arbitrary project files and transmit them through legitimate network channels without per-file confirmation or an audit trail.This creates a structural codebase-exfiltration risk for proprietary algorithms, product specifications, infrastructure configurations, and embedded secrets.
- Incident coverage: Five incidents mapped cleanly to the taxonomy and collectively covered six of its seven threat categories.The validated categories included supply chain compromise, consent abuse, code execution, data exfiltration, and persistence; prompt injection was supported by independent demonstrations and empirical study.
7 Discussion
The discussion maps defenses and open challenges across Agent Skills’ threat categories, showing that several severe risks require architectural reform rather than isolated mitigations.
- No single mitigation addresses all threat categories across the Skill content, distribution, runtime, and trust-model layers.
- Direct prompt injection remains unresolved because malicious instructions occupy the same operator layer as legitimate Skill behavior.
- Sandboxing can limit malicious scripts, but broad filesystem or network requirements make uniform isolation incompatible with some legitimate Skills.
- Behavioral monitoring is constrained by the absence of formal specifications for legitimate Skill network activity and action sequences.
- Natural-language behavior, scalable supply-chain integrity, multi-agent trust, automated vetting, and specification-level guarantees remain unresolved research challenges.
- Stakeholders are advised to combine marketplace review, script and instruction analysis, dependency provenance checks, namespace governance, and reputation systems.
8 Related Work
Related work covers LLM adversarial robustness, extension ecosystems, software supply chains, and LLM-agent security, but leaves Agent Skills’ combined trust, permission, and supply-chain properties insufficiently addressed.
- LLM Adversarial Robustness: LLM robustness research studies jailbreaks, prompt injection, model extraction, and membership inference, but does not address trust establishment, permission scoping, or supply-chain compromise.
- Extension Ecosystem Security: Browser extensions and IDE plugins provide relevant precedents because they combine community contribution, dynamic loading, and broad permissions.
- Software Supply Chain Security: Software supply-chain research addresses repository compromise, malicious-package detection, dependency confusion, and cryptographic provenance verification.
- LLM-based Agent Security: LLM-agent security surveys cover broad threats, privacy, ethics, countermeasures, and multi-agent trust dynamics.
9 Conclusion
The paper analyzes Agent Skills through a four-phase lifecycle, a threat taxonomy, and five confirmed incidents, concluding that the most severe risks exceed incremental mitigation.
- The analysis covers four lifecycle phases, seven threat categories, seventeen scenarios, and five confirmed incidents.
- Prompt injection, the consent gap, and supply-chain integrity require structural changes because existing mitigations cannot fully resolve them.