SkillAttack: Automated Red Teaming of Agent Skills through Attack Path Refinement

Fuente: arXiv
Saved in:
Bibliographic Details
Main Authors: Duan, Zenghao, Tian, Yuxin, Yin, Zhiyi, Pang, Liang, Deng, Jingcheng, Wei, Zihao, Xu, Shicheng, Ge, Yuyao, Cheng, Xueqi
Format: Preprint
Published: 2026
Subjects:
Online Access:
Tags: Add Tag
No Tags, Be the first to tag this record!
_version_ 1866915918929461248
author Duan, Zenghao
Tian, Yuxin
Yin, Zhiyi
Pang, Liang
Deng, Jingcheng
Wei, Zihao
Xu, Shicheng
Ge, Yuyao
Cheng, Xueqi
author_facet Duan, Zenghao
Tian, Yuxin
Yin, Zhiyi
Pang, Liang
Deng, Jingcheng
Wei, Zihao
Xu, Shicheng
Ge, Yuyao
Cheng, Xueqi
contents LLM-based agent systems increasingly rely on agent skills sourced from open registries to extend their capabilities, yet the openness of such ecosystems makes skills difficult to thoroughly vet. Existing attacks rely on injecting malicious instructions into skills, making them easily detectable by static auditing. However, non-malicious skills may also harbor latent vulnerabilities that an attacker can exploit solely through adversarial prompting, without modifying the skill itself. We introduce SkillAttack, a red-teaming framework that dynamically verifies skill vulnerability exploitability through adversarial prompting. SkillAttack combines vulnerability analysis, surface-parallel attack generation, and feedback-driven exploit refinement into a closed-loop search that progressively converges toward successful exploitation. Experiments across 10 LLMs on 71 adversarial and 100 real-world skills show that SkillAttack outperforms all baselines by a wide margin (ASR 0.73--0.93 on adversarial skills, up to 0.26 on real-world skills), revealing that even well-intended skills pose serious security risks under realistic agent interactions.
format Preprint
id arxiv_https___arxiv_org_abs_2604_04989
institution arXiv
publishDate 2026
record_format arxiv
spellingShingle SkillAttack: Automated Red Teaming of Agent Skills through Attack Path Refinement
Duan, Zenghao
Tian, Yuxin
Yin, Zhiyi
Pang, Liang
Deng, Jingcheng
Wei, Zihao
Xu, Shicheng
Ge, Yuyao
Cheng, Xueqi
Cryptography and Security
LLM-based agent systems increasingly rely on agent skills sourced from open registries to extend their capabilities, yet the openness of such ecosystems makes skills difficult to thoroughly vet. Existing attacks rely on injecting malicious instructions into skills, making them easily detectable by static auditing. However, non-malicious skills may also harbor latent vulnerabilities that an attacker can exploit solely through adversarial prompting, without modifying the skill itself. We introduce SkillAttack, a red-teaming framework that dynamically verifies skill vulnerability exploitability through adversarial prompting. SkillAttack combines vulnerability analysis, surface-parallel attack generation, and feedback-driven exploit refinement into a closed-loop search that progressively converges toward successful exploitation. Experiments across 10 LLMs on 71 adversarial and 100 real-world skills show that SkillAttack outperforms all baselines by a wide margin (ASR 0.73--0.93 on adversarial skills, up to 0.26 on real-world skills), revealing that even well-intended skills pose serious security risks under realistic agent interactions.
title SkillAttack: Automated Red Teaming of Agent Skills through Attack Path Refinement
topic Cryptography and Security
url https://arxiv.org/abs/2604.04989