SkillConsist: Detecting Inconsistencies in Agent Skills via Bidirectional Graph Alignment
Chaofan Meng, Yuhang Zheng, Yingnan Zhou, Sihan Xu
cs.LG, cs.AI
Submitted: 2026-08-07
Updated: 2026-08-11
Comments: 11 pages, 3 figures
License: http://creativecommons.org/licenses/by/4.0/
The gist: Agent Skills provide reusable capabilities to LLM agents.
Terminology
Abstract
Agent Skills provide reusable capabilities to LLM agents. Agent Skill inconsistencies can expose undisclosed dangerous behavior or cause wrong Skill selection. Recent Agent Skill research has increasingly examined Agent Skill consistency detection. Existing methods evaluate behaviors or security-property graphs against predefined categories or declared scopes. More recently, PL-HCL uses an LLM-based model to learn consistency across metadata, instructions, and resources. However, declaration and implementation behavior can be mixed across text and code, and a concise declaration can correspond to multiple connected implementation steps. We present SkillConsist to address both challenges. An LLM separates declaration and implementation content into behavior records on the implementation and declaration sides, while static analysis supplements implementation records. These records form declaration and implementation behavior graphs, respectively. Starting from a behavior record on either side, bidirectional graph alignment searches the other graph for a candidate subgraph and expands it along behavior relations until it completely expresses the source-side behavior. Graph differencing identifies conflicts between aligned subgraphs and outputs the detection results. We construct a 633-Skill benchmark from ClawHub's 500 most-downloaded public Skills and 133 Skill-Inject packages. The benchmark contains 319 inconsistent and 314 consistent Skills and 442 localized inconsistency annotations. On this benchmark, SkillConsist achieves 86.85% precision, 89.03% recall, and 87.93% F1 for package-level detection, improving F1 over the best baseline by 20.43 percentage points. For localization, it achieves 67.60% precision, 58.14% recall, and 62.52% F1.
Sources
- AIP: A Graph Representation for Learning and Governing Agent Skills
- MalSkillBench: A Runtime-Verified Benchmark of Malicious Agent Skills
- Do Skill Descriptions Tell the Truth? Detecting Undisclosed Security Behaviors in Code-Backed LLM Skills
- NEXUS: Structured Runtime Safety for Tool-Using LLM Agents
- SkillSieve: A Hierarchical Triage Framework for Detecting Malicious AI Agent Skills
- MalTool: Malicious Tool Attacks on LLM Agents
- SkillJect: Effectively Automating Skill-Based Prompt Injection for Skill-Enabled Agents
- Towards Secure Agent Skills: Architecture, Threat Taxonomy, and Security Analysis
- "Do Not Mention This to the User": Detecting and Understanding Malicious Agent Skills in the Wild
- Agent Skills in the Wild: An Empirical Study of Security Vulnerabilities at Scale
- ToolSafe: Enhancing Tool Invocation Safety of LLM-based agents via Proactive Step-level Guardrail and Feedback
- Deep Just-In-Time Inconsistency Detection Between Comments and Source Code
- Skill-Inject: Measuring Agent Vulnerability to Skill File Attacks
- Prompt Injection Attack to Tool Selection in LLM Agents
- Description-Code Inconsistency in Real-world MCP Servers: Measurement, Detection, and Security Implications
- Code Comment Inconsistency Detection with BERT and Longformer
- Skill Coverage: A Test Adequacy Metric for Agent Skills
- AgentSpec: Customizable Runtime Enforcement for Safe and Reliable LLM Agents
- Behavioral Integrity Verification for AI Agent Skills
- Cross-Layer Misalignment Detection in Agent Skills: A Progressive Loading-Aware Contrastive Learning Approach
Related papers
- Polynomial-Augmented Neural Networks (PANNs) with Weak Orthogonality Constraints for Enhanced Function and PDE Approximation
- AIRL-S: Unifying Reinforcement Learning and Search-Based Test-Time Scaling via Adversarial Inverse Reinforcement Learning
- Transformers as Bayesian In-Context Experimenters: Smoothness-Adaptive Efficient ATE Estimation
- Convergence issues in Relational Concept Analysis based on AOC-posets
- Beliefs Beyond Posteriors: The Predictive Cost of ELBO Binding
- Understanding Diffusion Models via Ratio-Based Function Approximation with SignReLU Networks