Source-linked AI summary
Pretext: Defeating Malicious Skill Detection Frameworks for AI Agents
Tobias Kaiser, Aritra Dhar
TL;DR
Skill verification frameworks combine static checks with LLM judgment, but the paper asks whether an attacker who knows the detector can still evade them. PRETEXT iteratively crafts skills and tests both frozen and co-adaptive detectors; it reports attack success rates up to 97% and 77%, respectively.
Problem
Skill verification frameworks combine static checks and LLM judgment, yet the paper investigates whether an attacker informed about the detector can evade both stages.
Source: §1 · p. 1Method
Results
PRETEXT achieves up to 97% attack success against a frozen detector and up to 77% against a co-adaptive one.
Source: §1 · p. 1Takeaways & Limitations
The reported results reveal vulnerabilities in existing skill analyzers, including when the detector learns heuristics alongside the attacker.
Source: §1 · p. 2, §5 · p. 4PRETEXT was not evaluated against commercial scanners because their rules and specifications are proprietary and non-public.
Source: §5 · p. 4
Abstract
from arXiv · showhide
Skills extend an agent's capabilities by injecting instructions and information into the context, and are widely used by agents such as OpenClaw and Claude Code. Prior work shows third-party marketplaces host malicious skills that give attackers direct influence over the victim's agent. The emerging defense scans skills before installation, pairing deterministic static checks with an LLM-based semantic judge, as in NVIDIA's SkillSpector. We show that such defenses fall to an attacker who knows the detector. Our white-box LLM attacker, Pretext, iteratively crafts skills that evade detection while still delivering the payload and performing the benign task: moving the payload from code into natural language leaves static analysis inert, while framing it as the skill's legitimate purpose and splitting instructions across files keeps the LLM stage below its blocking threshold. Across three open-source models, Pretext achieves up to 97\% and 77\% against a frozen detector and a co-adaptive one, respectively, revealing major gaps in current skill scanners.
1 Introduction
Skills expand agents’ capabilities but also expose them to attacker-controlled instructions, motivating verification frameworks that combine static checks with LLM judgment. PRETEXT exploits both stages through an informed, iterative attacker and achieves high attack success in fixed and adaptive detector settings.
1 Introduction
- Up to 97% against a frozen detector and 77% against a co-adaptive detector, PRETEXT achieves high attack success rates.The introduction also reports high success across both scenarios and multiple models.Source: §1 · pp. 1–2
- PRETEXT’s white-box attacker knows the detector’s rule set and iteratively crafts a malicious payload to evade detection.The attack targets both static analysis, by placing payloads in natural language, and the LLM stage, by framing behavior as the skill’s purpose and splitting it across files.Source: §1 · pp. 1–2
- PRETEXT evaluates both a frozen detector and an adaptive detector that learns heuristics to defend against the attacker.The adaptive setting is more challenging because the defender adapts to the attacker’s strategy.Source: §1 · pp. 1–2
2 Settings and Related Work
Prior work documents malicious skills and verification approaches, while PRETEXT targets weaknesses in detectors that combine static checks and LLM judgment. Its distinguishing features are cross-generation attacker memory and evaluation against an adaptive defender.
2 Settings and Related Work
- Verification frameworks use static analysis, LLM judges, or combinations; SkillSpector combines deterministic checks, semantic intent analysis, and an LLM meta-analyzer.The paper identifies SkillSpector as a representative target and notes commercial scanners describe a similar static-plus-LLM recipe.Source: §2 · p. 2
- Prior work has generated malicious skills through attacker-victim-evaluator rewriting [12], malicious code or configuration [13], encrypted payloads [14], and poisoning [15].Other work exploits latent flaws in unmodified benign skills [16] [17].Source: §2 · p. 2
- PRETEXT carries lessons across generations to find detector weaknesses, unlike prior iterative loops that re-derive attacks per skill [12].It also evaluates a GAN-style co-evolution in which the detector grows heuristics as the attacker adapts.Source: §2 · p. 2
3 PRETEXT Attack Overview
PRETEXT models skill attacks as iterative interactions among an attacker, a detector, a victim, and a verdict model. Its attacker refines skills using detection or delivery feedback, with attacker-only and co-adaptive detector modes.
3 PRETEXT Attack Overview
- When detection occurs, PRETEXT refines using fired rules; when the skill evades, the victim runs and delivery failures feed the victim’s output and verdict back to the attacker.Refinement is capped at iter = 3.Source: §3 · p. 2, Figure 2 · p. 2
- A run succeeds only when the skill evades detection, delivers its payload, and completes the benign task, as judged by a verdict LLM.The possible run outcomes are success, detected, or payload_failed.Source: §3 · pp. 2–3
- The attacker knows SkillSpector’s base rules and semantic-analyzer prompts, but not its exact score or threshold or Mode B’s learned heuristics.The attack type remains fixed during a run; skills may vary their cover story, file layout, and payload location, including across files.Source: §3 · p. 3
- Across generations, PRETEXT accumulates and reflects on lessons for each attack type, promoting confirmed hypotheses and discarding incorrect ones.The 12 attack types run in parallel before proceeding to the next generation.Source: §3 · p. 3
4 PRETEXT Evaluation
PRETEXT was evaluated against three detector models in fixed and adaptive settings, with attacker memory dynamics and detector behavior also measured. It achieved high success against frozen detectors, while adaptive detection lowered success but brought high false-positive rates and incomplete coverage of attacker lessons.
Setup
- Evaluation used glm as the PRETEXT attacker against glm, qwen3t, and gpt-oss detector, victim, and benign-generator roles across 12 attack types.Mode A ran for 10 generations and Mode B for 6; each was repeated five times, with blind and informed conditions in Mode B.Source: §4 · p. 3
Evaluation metrics
- Self-convergence measures similarity of attacker memory across generations, while plasticity measures how its lessons evolve; high convergence with low plasticity indicates stabilization.The figure reports these metrics at the final generation and shows mean values over five replicates.Source: §4 · p. 3, Figure 4 · p. 4
Mode A
- 96.7 ASR against qwen3t, 63.2 against glm-5.1, and 70.5 against GPT-OSS show high success against every frozen detector.The reported values are per-model ASR; the authors attribute differences to detector model selection.Source: §4 · pp. 3–4, Figure 4 · p. 4
Mode B
- In adaptive Mode B, ASR fell across all three models, but false positives reached 62% for gpt-oss blind and lesson coverage was only 0.33 for gpt-oss.The authors report that high false positives reduce benign utility, so lower ASR does not necessarily mean better security.Source: Figure 4 · p. 4, §4 · p. 4
5 Discussion and Conclusion
The paper concludes that PRETEXT can achieve high attack success against SkillSpector, including when its detector adapts. It cautions that commercial-scanner transfer remains untested and argues that lower attack success can come at the cost of benign utility.
5 Discussion and Conclusion
- Transfer to commercial scanners was not evaluated because their rules and specifications are proprietary and closed-source.The authors describe transfer to similar static-plus-LLM detectors as a conjecture, not a result.Source: §5 · p. 4
- A conservative detector can lower attack success while increasing false positives and reducing agent utility, so lower ASR alone does not establish better security.The authors recommend additional pipeline safeguards, including verification before tool execution, sandboxing, and restricted capabilities.Source: §5 · p. 4
- PRETEXT achieved high attack success against SkillSpector even when its detector learned and improved its defense.The authors state that the approach may extend to similar skill verifiers, while identifying a security flaw in current skill verification.Source: §5 · pp. 4–5
A SkillSpector Internals
SkillSpector combines deterministic checks with LLM-based semantic analysis and scoring, while PRETEXT models iterative attacks against frozen and co-evolving detectors. Its setup specifies the attack loop, learning process, paired benign controls, and information withheld from each role.
A SkillSpector Internals
- SkillSpector combines regex, code, taint, malware, dependency, and MCP checks with semantic analyzers for injection, intent mismatch, and policy risks.It includes 64 deterministic patterns across 16 categories and three LLM-based analyzers: Security Discovery, Developer Intent, and Quality Policy.Source: A SkillSpector Internals · p. 8
- Semantic analyzers flag findings above confidence 0.6, then a per-file meta-analyzer can retain or drop them; under –no-llm, both stages are skipped.The meta-analyzer cannot add findings or change their severity, and skills with no deterministic hits may still be flagged.Source: A SkillSpector Internals · p. 8, Figure A.1 · p. 9
- SkillSpector scores surviving findings by severity-point sum, applies a 1.3 bundle-wide multiplier if any executable script is present, and counts scores below 20 as evasion.Confidence, file location, and finding count do not otherwise affect the score.Source: A SkillSpector Internals · p. 10
B.1 Roles and the one-run loop
- PRETEXT runs an attacker–detector loop: detected skills are refined using fired rules, while evaded skills reach a victim and receive delivery feedback if the payload fails.Runs end as success, detected, or payload_failed, with refinement capped at three iterations.Source: §B.1 · p. 11
B.2 Attack types
- PRETEXT assigns one of 12 fixed attack types per run, each with a payload goal, success criterion, and synthetic victim capabilities.The multi-vector type requires payloads to be spread across files; no actions are executed in the study.Source: §B.2 · p. 11, Table B.1 · p. 12
B.3 Persistent memory and reflection
- PRETEXT’s attacker memory accumulates lessons across generations, while Mode A keeps SkillSpector frozen and Mode B adds a detector that learns heuristics from mistakes.In Mode B, false negatives inform new heuristics and false positives prompt narrowing or retraction.Source: §B.3 · pp. 11–12, §B.4 · p. 12, §B.5 · p. 12
B.5 Mode B: a co-evolving detector; B.6 Blind versus informed
- Mode B pairs each malicious skill with a benign skill in the same domain, so heuristics that flag both count as false positives and can be revised.Blind and informed conditions differ by prompts that disclose whether the opponent adapts; prompts and learned memories remain hidden from the other side.Source: §B.5 · p. 12, §B.6 · pp. 12–13
B.7 What each call sees, and from where
- The attacker optimizes the same predefined success criterion used by the verdict judge, but sees only fired rules—not detector scores, thresholds, severity weights, or learned heuristics.The judge sees the attacker’s payload description and benign task plus the victim’s output, not the SKILL.md.Source: §B.7 · p. 13
C Experimental Setup and Metrics
The experiments use one fixed attacker model against three detector, victim, and benign-generator stacks, with repeated runs in frozen and adaptive modes. The paper defines memory-change and attacker–detector coupling metrics, with coupling interpreted as memory similarity rather than verified blocking.
Experimental Setup
- Experiments use a fixed GLM-5.1 attacker against GLM, Qwen3T, and GPT-OSS stacks, with five replicates per condition and up to 10 or six generations.Mode A has 12 runs per generation and a frozen detector; Mode B uses 12 runs per generation in blind and informed conditions, each starting from the same cold-start memory seed.Source: C Experimental Setup and Metrics · p. 13
Data quality
- Timed-out SkillSpector scans are excluded as invalid samples, and the excluded share is negligible for GLM and Qwen3T but sizable for GPT-OSS.In Mode B, benign controls are scanned every generation, so false-positive rates use the full benign set.Source: C Experimental Setup and Metrics · p. 14, Table C.1 · p. 14
Metrics
- Memory-change metrics track births, deaths, and refinements across generations; coupling metrics count attacker lessons matched to detector heuristics at cosine similarity ≥0.40.These are memory-to-memory matches, not verified scan blocks; mean time-to-counter covers only matched lessons and should be read alongside coverage.Source: C Experimental Setup and Metrics · pp. 14–15, Table C.2 · p. 15
D.1 Mode A: what the attacker learns
Across target stacks, attacker memory converges structurally, but its restructuring and success patterns vary with target hardness. In Mode B, the detector that suppresses attacks most visibly does so with many false positives, while co-evolution awareness has modest, inconsistent effects.
D.1 Mode A: what the attacker learns
- Against qwen3t, the attacker solves the target quickly and consolidates; against glm it keeps restructuring without fully solving, while gpt-oss shows an upward learning curve.Structural convergence saturates against every stack, but the amount of restructuring differs.Source: §D.1 · p. 15, Table D.1 · p. 16
D.2 Mode B: co-evolution and effort
- gpt-oss is the only Mode-B stack whose attacker curve falls within a run, but its detector counters lessons slowest, covers fewest lessons, and flags many benign skills.The authors describe this as a non-deployable operating point; glm and qwen3t keep false positives usable.Source: Table D.2 · p. 16, §D.2 · p. 16
D.3 Iterations to success
- Every stack needs more refinement iterations in Mode B than Mode A, while blind and informed conditions remain indistinguishable in the reported effort curves.Only Mode A against qwen3t shows a clear downward effort trend; harder targets and Mode B stay flat or drift upward.Source: §D.3 · p. 16
D.4 Adaptation over generations
Memory plasticity declines as both sides consolidate, but the side still searching depends on the target stack. Across generations, attacker lessons converge while detector coverage follows different trajectories by stack.
Adaptation over generations
- Memory plasticity starts fully high and then consolidates; the attacker settles fastest against qwen3t, while the Mode-B detector settles fastest on glm and keeps reshaping on qwen3t and gpt-oss.The role still searching shifts to the attacker against a soft target and to the detector against a hard one.Source: §D.4 · p. 16, Figure D.2 · p. 17
- Refinement dominates deletion across stacks, and Mode B reshapes more than Mode A through both refinement and lesson birth.Table D.3 reports deleted, born, and refined lesson shares averaged across generations and replicates.Source: §D.4 · pp. 16–17, Table D.3 · p. 17
- Attacker memory self-convergence rises toward a stable repertoire, while detector coverage climbs on glm, stays roughly flat on qwen3t, and plateaus low on gpt-oss.The gpt-oss detector’s learned heuristics match little of the attacker’s playbook.Source: §D.4 · p. 17, Figure D.3 · p. 18
D.5 Exemplary learned memories
The learned memories expose reusable ways to evade parts of the scanner, alongside boundaries imposed by cross-file data-flow detection, the victim agent, and adaptive heuristics. They also show how benign false positives can force detectors to narrow broad rules.
D.5 Exemplary learned memories
- Splitting objectives across files and replacing code patterns with natural-language instructions exploit per-file analysis and static triggers, leaving the victim to reconstruct intent.The attacker independently rediscovers both strategies across stacks.Source: §D.5 · p. 18
- Genuine cover can remove description–behavior mismatch but does not defeat SSD-3, while Markdown avoids the code-risk multiplier and AST checks.The memories identify cross-file data-flow tracing as a defense the playbook cannot reliably beat.Source: §D.5 · p. 18
- Reading environment values and transmitting them externally remains extremely hard to evade with SSD-3, regardless of cover, framing, or permission declarations.A self-contained helper tool is the only proven evasion path for exfiltration-type attacks.Source: §D.5 · p. 18
- The detector narrowed an overbroad .env heuristic after it also flagged a benign skill, converging on the read-and-transmit flow.The attacker and detector approach that pattern from opposite sides.Source: §D.5 · p. 19
- gpt-oss retains broad, mostly unconfirmed heuristics that also flag legitimate deployment, monitoring, and telemetry skills, producing the highest false-positive rate.glm and qwen3t instead narrow their heuristics to the read-and-transmit flow.Source: §D.5 · p. 19
- Informed adaptation can overturn earlier lessons: gpt-oss reports CI/CD framing failing as the detector strengthens, while glm reports variable credential-redaction behavior.These reversals change attacker reasoning more than aggregate success.Source: §D.5 · p. 19
D.6 How much the static layer catches on its own
The deterministic layer alone catches only a small share of final-generation skills, and this estimate overstates its contribution within the full pipeline.
D.6 How much the static layer catches on its own
- 5.6% of final-generation attacker skills reach the static-only detection threshold, an overestimate because findings pass unfiltered without the LLM stages.The skills were optimized against the full detector, so this indicates the static layer is not the binding constraint, not that static-targeting attacks trivially succeed.Source: §D.6 · pp. 19–20, Table D.4 · p. 20