PaperlayerView exact revision on arXiv

Source-linked AI summary

Understanding and Mitigating Cross-Session Attacks via Persistent Artifacts in Agent Skill Composition

Dianshu Liao, Shidong Pan, Guangdong Bai, Zhenchang Xing, Xiaoyu Sun

arXiv:2610.13227v1cs.CRcs.SE

TL;DR

Persistent artifacts can carry malicious influence across skill sessions, while existing evaluations have not adequately examined coordinated attacks through those artifacts. The paper characterizes three attack patterns, benchmarks them, and proposes SkillRelayGuard; its evaluation shows reduced attack success alongside improved task completion.

  • Problem

    Existing evaluations do not adequately examine attacks coordinated across independent sessions through persistent artifacts, despite legitimate workflows relying on artifact reuse.

    Source: §1 · p. 2

  • Method

    The paper defines three artifact-mediated attack patterns, evaluates them with SkillRelayBench, and proposes SkillRelayGuard to restore provenance context and provide pre-execution advisory review.

    Source: §1 · p. 2

  • Results

    Overall ASR decreases from 69.5% to 10.9% and ACSR from 54.8% to 10.0%, while TSR increases from 79.6% to 87.5% with SkillRelayGuard.

    Source: §1 · pp. 2–3

  • Takeaways & Limitations

    Artifact handoffs are trust boundaries requiring renewed scrutiny; provenance explains how content was produced but does not establish correctness or authorize embedded requests.

    Source: §8 · p. 17

    The evaluation does not replace repeated runs within configurations, and the ablation uses only Codex CLI, leaving component generalizability to other configurations uncertain.

    Source: §8 · p. 17

Abstract

from arXiv · show

Agent skills extend the capabilities of AI agents by bundling instructions, code, and resources into reusable packages. During skill execution, agents may produce or modify artifacts, such as files, configurations, and cached data, that are reused by other skills in later sessions. Since these artifacts can persist across sessions and later be accessed by other skills, they introduce a new attack surface that can be exploited to influence subsequent executions. However, the security risks arising from such cross-session skill interactions remain largely unexplored. In this work, we investigate cross-session composition attacks in skill-based AI agents and develop a runtime defense against them. Specifically, we characterize three attack mechanisms, namely Instruction Propagation (IP), Data Boundary Violation (DBV), and Evidence Poisoning (EP), through which malicious effects propagate across skill executions via persistent artifacts. To evaluate whether existing agents can resist these attacks while completing legitimate tasks, we construct SkillRelayBench, a benchmark of 270 adversarial cases drawn from 30 cross-session skill-composition scenarios across ten domains. Our evaluation of seven models across Codex CLI, Gemini CLI, and Claude Code reveals attack success rates (ASR) ranging from 46.7% to 77.4% and attack chain success rates (ACSR) ranging from 35.6% to 61.1%. Successful attack chains cover all five target security consequence categories, highlighting the broad impact of these attacks. To mitigate these risks, we propose SkillRelayGuard, which restores artifact provenance context and provides pre-execution advisory review while leaving the final execution decision to the agent. Evaluation across three agent settings shows that SkillRelayGuard reduces overall ASR from 69.5% to 10.9% and ACSR from 54.8% to 10.0%, while increasing legitimate task completion from 79.6% to 87.5%.

1 Introduction

Persistent artifacts let attackers carry influence from one skill session into another, even after conversation history is lost. The paper characterizes these attacks, measures their success, and proposes a runtime defense that supports artifact reuse.

1 Introduction

  • Cross-session artifact reuse connects workflow stages but lets attacker-controlled upstream and downstream skills propagate malicious influence without direct between-session file tampering.Rejecting artifacts would interrupt legitimate workflows, while trusting their instructions and factual claims could perpetuate attacks.Source: §1 · pp. 1–2
  • The authors define Instruction Propagation, Data Boundary Violation, and Evidence Poisoning, then build SkillRelayBench with 270 cases from 30 scenarios across ten domains.The evaluation preserves artifacts, resets conversation history, and separately assesses task completion, security consequences, and attack success through artifact handoff.Source: §1 · p. 2
  • ASR ranges from 46.7% to 77.4% and ACSR from 35.6% to 61.1% across seven models and three agent frameworks.In 53.0% of evaluations, agents completed the user's task while also achieving the attacker's objective.Source: §1 · p. 2
  • SkillRelayGuard restores artifact provenance and supporting evidence when artifacts are read, then gives an independent reviewer a chance to advise before operations execute.The system enforces context delivery and review but leaves the execution decision to the task agent.Source: §1 · p. 2
  • Overall ASR falls from 69.5% to 10.9% and ACSR from 54.8% to 10.0%, while TSR rises from 79.6% to 87.5% with SkillRelayGuard.Combining read-time context restoration with pre-execution review reduces attack success more than either intervention alone.Source: §1 · pp. 2–3

2 Background and Motivation

Skills use persistent artifacts to connect tasks across sessions, even when prior conversation history is not retained. A two-session example shows how a malicious request can move from a skill resource into an unauthorized action.

2.1 Skill Execution Across Sessions

  • Later sessions can read files or database records saved by earlier tasks, using them in a new execution context without inheriting the prior conversation.A skill package describes intended tasks and steps in SKILL.md and may include supporting code and resources.Source: §2.1 · p. 3

2.2 A Motivating Example

  • An attacker-controlled Doc-Summarizer plants an extra upload request in handoff_guidance, and Doc-Submitter later directs the agent to send an unauthorized copy.The agent also completes the user-requested submission; the attacker does not edit the artifact between sessions, and the user's authorization remains limited to the designated portal.Source: §2.2 · pp. 3–4, Figure 1 · p. 4

3 Threat Model and Attack Patterns

The threat model gives attackers control of multiple third-party skills but not user tasks, trusted policies, the agent, or direct between-session file edits. The paper distinguishes three ways malicious influence can pass through artifacts into later tasks.

3.1 Threat Model

  • Attackers can modify multiple third-party skill packages to influence later execution through artifacts, but cannot change user tasks, trusted policies, the model, scaffold, session boundaries, or files between sessions.Attacks operate within existing file and tool permissions; technical access does not itself authorize data use or operations.Source: §3.1 · p. 4

3.2 Attack Patterns

  • Instruction Propagation changes operations, Data Boundary Violation changes the scope of data used, and Evidence Poisoning changes the factual basis of decisions.The patterns describe mechanisms rather than injection locations.Source: §3.2 · pp. 4–5
  • Examples include planting a later upload instruction, importing private records beyond the authorized scope, and falsely recording issues with workarounds as resolved.A downstream skill can then execute the upload, disclose the private records, or produce an FAQ that falsely reports resolution.Source: §3.2 · p. 5

4 SkillRelayBench

SkillRelayBench evaluates attacks that move through persistent artifacts across separate skill sessions, while checking both security consequences and legitimate task execution. It pairs validated benign workflows with adversarial skill variants and uses isolated execution and independent judges to assess outcomes.

4.1 Benchmark Construction

  • Thirty scenarios across ten business domains pair two related tasks so artifacts produced in one session can be reused in the next.Each scenario begins with a legitimate business objective and original materials; benign implementations are validated before adversarial variants are constructed.Source: §4.1 · pp. 6–7

4.2 Evaluation Harness

  • The harness runs the two tasks in fresh sessions that share a workspace but not conversation history, then independent judges assess task completion and attack outcomes.Execution evidence includes traces and workspace snapshots; evaluation criteria are kept separate from task inputs.Source: §4.2 · pp. 7–8

4.3 Dataset Composition

  • The benchmark contains 270 adversarial cases across 30 scenarios and ten domains, with 90 cases per attack pattern and ten primary artifact formats.It targets five consequence categories; unauthorized disclosure accounts for 35.6% of cases and unauthorized operation for 23.3%.Source: §4.3 · p. 8

4.4 Evaluation Metrics

  • ASR measures whether a target consequence occurs, ACSR whether it occurs through the intended cross-session chain, and TSR whether both user tasks are completed.Task completion focuses on execution rather than comprehensive output validation, so a run may count as both task success and attack success.Source: §4.4 · pp. 8–9

5 Empirical Evaluation

Across seven model configurations and three agent scaffolds, the evaluation finds substantial attack success and successful cross-session chains. Outcomes vary by attack pattern, injection surface, artifact format, and target consequence; task completion can occur alongside an attack.

5.1 Experimental Setup

  • Seven model configurations were evaluated on all 270 cases, yielding 1,890 runs with artifacts retained between sessions but not across runs.The configurations span Codex CLI, Gemini CLI, and Claude Code; independent judges assessed task and attack outcomes.Source: §5.1 · p. 9

5.2 RQ1: Overall Agent Performance

  • 46.7%–77.4% ASR and 35.6%–61.1% ACSR across configurations show that attacks often succeed, including through the intended cross-session chain.The table reports overall ASR of 64.7% and overall ACSR of 50.2%.Source: Table 3 · p. 10, §5.2 · p. 10
  • 53.0% of runs completed the user’s task while also achieving the attack objective, so task completion alone does not establish safe execution.Across all 1,890 runs, 834 achieved both task completion and the complete cross-session attack chain, accounting for 44.1% of runs.Source: §5.2 · p. 10

5.3 RQ2: Variation Across Attack Characteristics

  • Evidence Poisoning had the highest overall ACSR among attack patterns at 61.0%, while supporting-code injection led injection surfaces with 70.2% ASR and 59.0% ACSR.Evidence Poisoning’s ASR was 68.3%; code injection was not the leading surface for every configuration.Source: §5.3 · pp. 10–11
  • Successful attack chains occurred across all ten artifact formats, with ACSR ranging from 36.5% to 69.8%; format differences do not establish an independent format effect.Pooled ACSR was 48.3% for SQLite, 54.0% for JSON, and 44.0% for XLSX.Source: §5.3 · p. 11, Figure 6 · p. 11
  • Successful chains occurred in all five security consequence categories, with pooled ACSR ranging from 44.2% to 79.4%.Software integrity violation had the highest ASR and ACSR, 88.9% and 79.4%, respectively, but covered only nine distinct cases.Source: §5.3 · p. 12, Table 5 · p. 12

6 SkillRelayGuard

SkillRelayGuard adds provenance context when artifacts are reused and advisory review before operations execute, while leaving execution decisions to the task agent. Its provenance records are built from evidence linking skills, actions, and artifact changes.

6 SkillRelayGuard

  • SkillRelayGuard associates artifacts with their originating skills and evidence, restores that context at read time, and reviews concrete operations before execution.The task agent, not the defense, makes the final decision to revise, abandon, or confirm an operation.Source: §6 · p. 12

6.1 Skill–Artifact Attribution

  • Attribution combines task context, skill content, tool activity, and artifact changes because no single source suffices to establish a skill–artifact association.An independent LLM proposes associations that must cite a skill requirement, a tool record, and corresponding artifact content or changes; the runtime validates citations and stores version-matched records.Source: §6.1 · pp. 12–13

6.2 Read-Time Context Restoration

  • After an artifact read, the runtime restores its originating task, associated skills, and evidence, while clarifying that embedded requests cannot expand user authorization.Because context arrives after the tool call, this step cannot intervene between a read and a send within the same call.Source: §6.2 · p. 13

6.3 Pre-Execution Advisory Review

  • Before an instrumented operation, an independent reviewer checks authorization, data scope, and support for consequential claims, then returns evidence and revision advice to the agent.Modified requests require another review, but the agent may still confirm execution after a hold recommendation.Source: §6.3 · pp. 13–14

6.4 Implementation

  • The prototype shares attribution, context construction, and review across Codex CLI, Claude Code, and Gemini CLI, with platform-specific adapters and GPT-5.4 for attribution and review.The runtime and provenance records are kept outside the attacker-controlled skill package and agent-writable workspace.Source: §6.4 · p. 14

7 Evaluation of SkillRelayGuard

SkillRelayGuard reduces cross-session attack success while preserving legitimate task completion, combining read-time context restoration with pre-execution review. Its evaluation covers three agent configurations, component contributions, and defense overhead.

7.1 Experimental Setup

  • The evaluation compares guarded and unguarded Codex CLI, Gemini CLI, and Claude Code configurations on the same 270 SkillRelayBench cases.Success rates are counted over all 270 cases per configuration and confirmed by the corresponding Judge.Source: §7.1 · p. 14

7.2 RQ3: Effectiveness

  • Overall ASR falls from 69.5% to 10.9% and ACSR from 54.8% to 10.0% with SkillRelayGuard across three configurations.These correspond to reductions of 58.6 and 44.8 percentage points, respectively; some attacks still succeed because agents retain the final content-level decision.Source: §7.2 · p. 15, Table 6 · p. 15

7.3 RQ4: Task Completion

  • Overall TSR rises from 79.6% to 87.5% with SkillRelayGuard, increasing in each of the three configurations.The authors attribute the pattern to supplying provenance context, evidence, and revision advice while leaving final decisions to the task-execution agent.Source: §7.3 · p. 15

7.4 RQ5: Ablation Study

  • The full defense reaches ASR 17.4% and ACSR 17.0%, outperforming review only by 8.5 and 7.8 percentage points.Context restoration alone yields ASR 73.3% and ACSR 58.5%, while review only yields 25.9% and 24.8%.Source: §7.4 · p. 16, Table 7 · p. 16
  • The full defense achieves 90.4% TSR, above Vanilla but below Context only at 93.3% and Review only at 95.2%.Its TSR is 4.8 percentage points above the unguarded baseline.Source: §7.4 · p. 16

7.5 RQ6: Defense Overhead

  • SkillRelayGuard averages 27.3K tokens and 91.5 seconds per case, accounting for 4.3% of total tokens and 40.2% of total runtime.The authors report similar absolute defense costs across agents, with relative shares varying because total workflow costs differ.Source: §7.5 · p. 16, Table 8 · p. 16

8 Discussion

The discussion frames persistent artifact handoffs as trust boundaries and argues for checking provenance, factual support, and authorization against the downstream task. It also identifies limitations in evaluation and benchmark coverage.

Persistent Artifacts as a Trust Boundary

  • Artifact content can become trusted evidence for downstream operations even without explicit malicious instructions, so handoffs require renewed scrutiny.Provenance explains how content was produced, not whether its claims are correct, and artifact availability does not authorize embedded requests.Source: §8 · p. 17

Beyond Blocking: Supporting Safe Task Completion

  • SkillRelayGuard combines mandatory context delivery and operation review with agent-controlled final decisions, supporting correction rather than simply blocking operations.The ablation finds limited defense benefits from provenance context alone, larger gains from review, and further attack reductions from combining both; the full approach has lower TSR than either single-intervention configuration.Source: §8 · p. 17

Threats to Validity

  • The ablation uses only Codex CLI, and the benchmark cannot exhaustively cover real-world scenarios, limiting generalization beyond the evaluated configurations and workflows.The authors also note that stochastic execution may vary across runs and that their cross-configuration evidence does not replace repeated runs within configurations.Source: §8 · p. 17

9 Related Work

Related work spans agent-skill security, persistent and cross-session attacks, and runtime defenses. This paper focuses on malicious influence carried through persistent artifact handoffs between skills across sessions.

Security of Agent Skills

  • Prior agent-skill security research includes ecosystem analysis, package auditing, runtime evaluation, and studies of attacks embedded in skill instructions, code, and resources.The paper situates its focus among work on capability, data, and trust transfer in skill composition, as well as skill modification and experience-driven evolution [32] [55] [59] [63].Source: §9 · pp. 17–18

Persistent and Cross-Session Agent Attacks

  • Related persistent-attack studies examine memory poisoning, stored-state influence, multi-turn attacks, behavioral drift, and harm across later tasks or sessions.This paper instead studies artifact handoffs in normal workflows, where skill packages influence upstream artifact generation and downstream skills guide later-session reuse.Source: §9 · p. 18

Runtime Defenses for Agents

  • Runtime defenses use information-flow control, permissions, and action checking; SkillRelayGuard combines read-time provenance restoration with pre-execution advisory review.It enforces context delivery and review while leaving the task-execution agent the choice to revise, abandon, or confirm an operation.Source: §9 · p. 18

10 Conclusion

The conclusion characterizes cross-session artifact attacks, introduces SkillRelayBench and SkillRelayGuard, and reports reduced attack success alongside improved task completion in the evaluated settings.

10 Conclusion

  • Across three agent configurations, SkillRelayGuard reduces overall ASR from 69.5% to 10.9% and ACSR from 54.8% to 10.0%, while TSR rises from 79.6% to 87.5%.The benchmark contains 270 adversarial cases from 30 scenarios across ten domains; the defense combines provenance context restoration and pre-execution advisory review while retaining the agent’s final decision.Source: §10 · p. 18

Related papers

Loading 2610.13227v1…