SkillHarm: Lifecycle-Aware Skill-Based Attacks via Automated Construction

arXiv:2606.02540 · cs.CL · Submitted 2026-06-01 · Read on arXiv

cs.CL

Submitted: 2026-06-01

Updated: 2026-10-11

Code: https://github.com/OSU-NLP-Group/SkillHarm

Project page: https://osu-nlp-group.github.io/SkillHarm

Terminology

• Benchmark — 2× in this paper · explained in 2 episodes
• Agent Skills — 1× in this paper · explained in 1 episode
• Fixed-Payload Poisoning — 1× in this paper
• Self-Mutating Poisoning — 1× in this paper

Sources

• AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents
• SkillAttack: Automated Red Teaming of Agent Skills through Attack Path Refinement
• WASP: Benchmarking Web Agent Security Against Prompt Injection Attacks
• SkillTrojan: Backdoor Attacks on Skill-Based Agent Systems
• SkillJect: Effectively Automating Skill-Based Prompt Injection for Skill-Enabled Agents
• SkillSafetyBench: Evaluating Agent Safety under Skill-Facing Attack Surfaces
• OS-Harm: A Benchmark for Measuring Safety of Computer Use Agents
• SkillsBench: Benchmarking How Well Agent Skills Work Across Diverse Tasks
• Towards Secure Agent Skills: Architecture, Threat Taxonomy, and Security Analysis
• "Do Not Mention This to the User": Detecting and Understanding Malicious Agent Skills in the Wild
• Agent Skills in the Wild: An Empirical Study of Security Vulnerabilities at Scale
• When Actions Go Off-Task: Detecting and Correcting Misaligned Actions in Computer-Use Agents
• Natural-Language Agent Harnesses
• Supply-Chain Poisoning Attacks Against LLM Coding Agent Skill Ecosystems
• Agent Skills Enable a New Class of Realistic and Trivially Simple Prompt Injections
• Skill-Inject: Measuring Agent Vulnerability to Skill File Attacks
• BadSkill: Backdoor Attacks on Agent Skills via Model-in-Skill Poisoning
• GuardAgent: Safeguard LLM Agents by a Guard Agent via Knowledge-Enabled Reasoning
• Agent Skills for Large Language Models: Architecture, Acquisition, Security, and the Path Forward
• RiOSWorld: Benchmarking the Risk of Multimodal Computer-Use Agents

Related papers

• Exploring Solution Divergence and Its Effect on Large Language Model Problem Solving
• Ishigaki-IDS-Bench: A Benchmark for Generating Information Delivery Specification from BIM Information Requirements
• Subliminal Steering: Stronger Encoding of Hidden Signals
• MedStruct-S: A Benchmark for Key Discovery, Key-Conditioned QA and Semi-Structured Extraction from OCR Clinical Reports
• The End of Transformers? On Challenging Attention and the Rise of Sub-Quadratic Architectures
• Untangling the Mechanisms of Misleading Context in Medical Question Answering