Agent Skill Security: Threat Models, Attacks, Defenses, and Evaluation
This paper studies security risks in reusable LLM-agent “skills” across their whole lifecycle—repository admission, retrieval, planning, execution, and evolution—rather than treating skill abuse as just prompt injection or unsafe runtime behavior. Its useful angle is the lifecycle threat taxonomy and SkillSec-Eval benchmark applied to 327 real-world skills, which makes the attack surface feel much broader and more concrete, though from the abstract it’s unclear how deep the proposed defenses are or how well the findings generalize beyond that repository.
Abstract
Reusable skills are becoming a fundamental building block of Large Language Model (LLM) agents, enabling capabilities to be packaged, shared, and reused across diverse applications. However, existing security research primarily focuses on prompt injection and runtime execution, leaving security risks throughout the broader skill lifecycle largely unexplored. In this paper, we present SkillSec-Eval, a lifecycle-aware framework for systematically evaluating the security of reusable agent skills. We first characterize the skill lifecycle and develop a threat taxonomy spanning repository admission, semantic retrieval, planner selection, execution, and skill evolution. We then instantiate this taxonomy in SkillSec-Eval and conduct a comprehensive empirical evaluation using a repository of 327 real-world skills. Our study demonstrates that vulnerabilities arise at multiple lifecycle stages beyond execution, highlighting the need for lifecycle-aware security analysis of reusable agent skills.