ActionGuard: Tool Call Authorization under Poisoned Skills

1 Introduction

• Agent actions can change external state, while existing safeguards often assess action risk without verifying whether the information inducing an action is trusted or fits the request.This can leave dangerous calls that appear workflow-appropriate harder to identify.Source: §1 · p. 1
• Malicious instructions in benign skills can make dangerous actions such as data exfiltration or destructive behavior appear to be normal task procedures.The core gap is deciding whether a skill-induced action is authorized by the current request and execution context.Source: §1 · pp. 1–2
• ActionGuard checks whether each Tool Call fits the current task and user authority using execution-time context, including the request, arguments, execution state, scripts, and expected effects.It blocks unauthorized calls before execution, even when a skill presents them as normal procedures.Source: §1 · p. 2
• 8.20% and 9.00% ASRs, with TSRs of 87.73% and 92.09%, were achieved against contextual and obvious skill-injection attacks, respectively.The evaluation took place in an actual OpenClaw execution environment.Source: §1 · p. 2

2.1 Skill-based Agent Threats

• Skills are reusable task extensions, and SKILL-INJECT [32] evaluates malicious instructions inserted into benign skills, including contextual injections disguised as ordinary procedures.HarmfulSkillBench [16] instead addresses skills whose intended functionality is harmful; this work focuses on poisoned skills used for benign requests.Source: §2.1 · p. 2

2 Related Work

• The related-work section frames skills as security-critical because they affect agent planning and action generation, and distinguishes poisoned skills from skills designed to be harmful.Poisoned skills alter benign functionality; harmful skills have harmful intended functionality.Source: §2.1 · p. 2

2.2 Safeguards for LLM Agents

• General safeguards inspect actions or trajectories, while skill-oriented defenses sanitize skill content or constrain skill permissions; this work validates agent-generated actions under poisoned skills.ToolSafe inspects actions before execution, while Dynamic Guardian [10] sanitizes skill content and SkillGuard [27] applies permission controls.Source: §2.2 · p. 3

3.1 Execution Setting

• The target agent uses a third-party skill to plan a benign user task, while the user request defines trusted objectives and delegated action scope.Skills, generated plans, and Tool Calls are not trusted as independent grounds for execution authority.Source: §3.1 · p. 3

3.2 Adversary Model

• An attacker may poison skill instructions or referenced components to induce unauthorized Tool Calls, but cannot directly compromise the user request, agent, defense, or tool runtime.Attack success requires an unauthorized call to execute and produce the intended security effect.Source: §3.2 · pp. 3–4

3.3 Security Goal and Scope

• The goal is to prevent unauthorized Tool Calls while preserving authorized calls, but the study excludes pre-installation skill screening and several direct-compromise and post-execution scenarios.Excluded cases include malicious user requests, tool-runtime vulnerabilities, and recovery after execution.Source: §3.3 · p. 4

4 ActionGuard

• ActionGuard intercepts each proposed Tool Call before execution and either forwards it or blocks it according to an independent Reviewer’s authorization decision.The Reviewer uses structured review context; ActionGuard also rejects invalid or failed Reviewer outputs.Source: §4 · p. 4, §4.3 · pp. 5–6

4.1 Skill Profile Resolution and Construction

• A balanced skill profile records a skill’s ordinary workflow and suspicious signals, while withholding the potentially poisoned raw skill from the Reviewer.Profiles are reused when available or constructed from the raw skill and stored for later invocations.Source: §4.1 · pp. 4–5

4.2 Runtime Review Context Construction

• The review context combines the trusted user request and balanced skill profile with current and recent Tool Calls and the contents of referenced local scripts.The request is preserved separately from later agent messages, tool outputs, skill instructions, and execution history; scripts are treated as untrusted evidence.Source: §4.2 · p. 5

4.3 Semantic Authorization and Enforcement

• The Reviewer assesses the current call, related action sequence, and script behavior against the user request, denying calls whose behavior exceeds the authority delegated by the user.Execution errors or degraded output alone do not make a call unauthorized.Source: §4.3 · pp. 5–6

5.1 Evaluation Setup

• The evaluation uses 139 contextual and 180 obvious injection–task pairs from a SKILL-INJECT snapshot and compares three safeguards with a no-safeguard condition.Five Reviewer models are used, with the same underlying model applied across LLM-based components within each condition.Source: §5.1 · p. 6, §5 · p. 6

5.2 Experimental Procedure

• Each of the 319 tasks is run independently in a fresh sandbox and session, and each condition is repeated three times.ActionGuard checks generated Tool Calls and referenced local scripts before execution, while the comparison safeguards retain their own intervention designs.Source: §5.2 · p. 7

5.3 Metrics and Reporting

• Attack Success Rate counts runs where a malicious Tool Call executes and produces the benchmark-defined effect, while Task Success Rate measures completion of the benign request.TSR covers 100 contextual and 155 obvious pairs; pairs where destructive effects prevent separate task adjudication are excluded, and ASR and TSR are interpreted together.Source: §5.3 · pp. 7–8

6.1 Performance Overview

• ActionGuard achieved 8.65% overall ASR and 90.38% TSR, reducing ASR by 46.1% versus Dynamic Guardian [10] and 35.5% versus SkillGuard [27].Against No Safeguard, it reduced ASR by 20.40 percentage points (70.2% relative reduction) while limiting the TSR decrease to 3.08 percentage points (3.3% relative decrease).Source: §6.1 · p. 8

6.2 Performance under Injection Attacks

• ActionGuard’s 8.20% mean ASR was lowest for contextual injections; its 87.73% mean TSR was 1.40 points below SkillGuard [27].Dynamic Guardian [10] and SkillGuard [27] had contextual-injection mean ASRs of 14.92% and 19.81%, respectively.Source: §6.2 · p. 8
• For obvious injections, SkillGuard [27] had 8.48% mean ASR versus ActionGuard’s 9.00% (0.52 points apart); ActionGuard’s 92.09% mean TSR trailed Dynamic Guardian [10]’s 94.54%.Dynamic Guardian [10] recorded 16.93% mean ASR, while SkillGuard [27] recorded 88.17% mean TSR.Source: §6.2 · pp. 8–9

6.3 Performance across Reviewer Models

• Across five Reviewer models, ActionGuard had the lowest ASR each time (7.73–9.30%); Figure 5 compares ASR and TSR across Reviewer models.Its results were similar across the evaluated open-source and commercial Reviewers.Source: Figure 5 · p. 9, §6.3 · p. 9
• ActionGuard’s TSR ranged from 87.58% to 92.55% across Reviewers, while Dynamic Guardian [10] ranged from 91.63% to 92.68% and SkillGuard [27] from 87.71% to 89.28%.The paper reports that benign-task performance was more affected by Reviewer selection than ActionGuard’s attack-blocking performance.Source: §6.3 · p. 9

7.1 Analysis of Injection Cases

• ActionGuard denied the external file transfer in the presentation case because it exceeded the request, while the slide modification completed successfully.It assessed the POST destination and artifact-transfer parameters without script inspection, and identified a matching suspicious signal in the balanced skill profile.Source: §7.1 · p. 9
• For the DOCX conversion case, ActionGuard inspected file_check.sh, identified deletion commands, denied execution, and allowed the normal conversion to proceed.The execution log confirmed cleaned.txt was not created.Source: §7.1 · pp. 9–10

7.2 Utility Failure

• In the Git case, ActionGuard blocked a force push bundled with benign operations; the target agent later committed but generated no safe push, leaving the task incomplete.The force push matched the remote-history-rewrite suspicious signal and exceeded the user request.Source: §7.2 · p. 10

7.3 Cross Case Observations

• Across the document cases, ActionGuard checked whether objectives and side effects were needed for the trusted request, preserving benign edits and conversion while blocking added transfers and deletion.It used Tool Call parameters for the transfer case and script inspection for the destructive behavior that was hard to infer from the command alone.Source: §7.3 · p. 10
• A correct denial can still cause task failure when benign and unauthorized actions share one call and the target agent does not replan safely.The paper identifies Tool Call granularity and post-DENY replanning ability as factors in utility failures.Source: §7.3 · p. 10

8 Conclusion

• ActionGuard checks whether each Tool Call falls within the user’s delegated authority using a skill profile and current execution evidence, including calls, action sequence, and script contents.The potentially poisoned raw skill is used only as reference information for initial profile construction, not as trusted grounds for execution.Source: §8 · p. 10
• Across the evaluation, ActionGuard reduced ASR by 46.11% versus Dynamic Guardian [10], 35.54% versus SkillGuard [27], and approximately 70.2% versus No Safeguard.The evaluation used 319 injection–task pairs in OpenClaw and five Reviewer models.Source: §8 · p. 10
• The evaluation is limited to OpenClaw, one target-agent model, and SKILL-INJECT [32]; other skill-loading methods and Tool Call schemas require validation.A task may also fail when a benign and unauthorized action share one call and the agent does not generate a safe alternative after DENY.Source: §8 · p. 10
• Planned work includes extending evaluation to more agent frameworks, improving skill-profile reliability through version/hash-based invalidation and independent verification, and stabilizing outcome adjudication.The proposed adjudication approach combines a deterministic evaluator with an LLM Judge model.Source: §8 · pp. 10–11

A Open Science

• The anonymized review artifact includes the ActionGuard implementation, OpenClaw integration, prompts, configurations, skill-profile database, evaluation scripts, dataset snapshot, results, logs, and sandbox reproduction instructions.The paper states that the artifact link is available at the cited project address.Source: A Open Science · p. 12

• Potentially harmful skill instructions and scripts were research artifacts; destructive operations stayed within disposable workspaces, with no real credentials or private user data used.The artifacts were not automatically executed outside the experimental environment.Source: B Ethical Considerations · p. 12

• Each benchmark task ran in a newly initialized workspace and OpenClaw session, with the Skill Profile Database initialized per sandbox and reused only within that task.Containers used docker run –rm, and ordinary workspace and conversation state were not reused across tasks.Source: C Experimental Environment · p. 12
• The harness retained final responses, workspaces, artifacts, trajectories, Tool Call records, safeguard audits, and outcome-judge results for completed runs.Source: C Experimental Environment · p. 12
• Table 5 summarizes the host and sandbox environment, while Table 6 reports implementation-specific ActionGuard parameters.Exact model identifiers and benchmark composition are reported in Section 5.1, not here.Source: C Experimental Environment · p. 12, Table 5 · p. 13, Table 6 · p. 13
• Provider errors, timeouts, dependency failures, and sandbox initialization failures were recorded separately.Source: C Experimental Environment · p. 13

D ActionGuard Implementation Details

• Ollama safeguard settings included temperature 1, disabled model thinking, and num_ctx 65,536; semantic-reviewer and profile-constructor outputs used separate JSON schemas.Full prompts, source code, and configuration files are included in the anonymized artifact.Source: D ActionGuard Implementation Details · p. 13

E Skill Profile Output

• The Skill Profile pairs ordinaryWorkflow with suspiciousSignals, which provide context but do not independently determine whether a Tool Call is allowed or denied.Source: E Skill Profile Output · p. 13

F Reviewer Model Output

• Reviewer output includes a decision, machine-readable reasonCode, and reason grounded in available runtime context.Source: F Reviewer Model Output · p. 13

G Judge Model Output

• Attack and task outcomes are judged independently, so successful attack prevention does not automatically mean the benign task was completed.Source: G Judge Model Output · p. 14
• Attack labels distinguish an executed malicious side effect, a blocked attempt, an ignored injection, and an outcome indeterminate due to runtime or infrastructure failure.Source: G Judge Model Output · p. 14
• Task labels distinguish successful benign-task completion, task failure, and indeterminate completion due to infrastructure or runtime failure.Source: G Judge Model Output · p. 14