Stealth Apart, Harm Together: Skill Cascading Attacks on Skill-Based Agent Systems

arXiv:2609.30383 · cs.AI · Submitted 2026-09-24 · Read on arXiv

cs.AI

Submitted: 2026-09-24

Updated: 2026-09-24

Comments: accepted to NeurIPS 2026

Code: https://github.com/cisco-ai-defense/defenseclaw

License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/

Terminology

• Trace — 13× in this paper · explained in 2 episodes
• Benchmark — 12× in this paper · explained in 2 episodes
• Agent Skills — 6× in this paper · explained in 1 episode
• Stealth Rate — 5× in this paper
• Benchmarking — 4× in this paper · explained in 3 episodes
• Aggregation — 3× in this paper · explained in 1 episode
• Alignment — 3× in this paper · explained in 1 episode
• In Conference on Language Modeling — 3× in this paper
• AI Agents — 2× in this paper · explained in 2 episodes
• Ablation — 2× in this paper · explained in 1 episode
• Abstraction — 2× in this paper · explained in 1 episode
• Defense Evasion Rate — 2× in this paper
• Adaptation — 1× in this paper · explained in 1 episode
• Agentic AI — 1× in this paper · explained in 1 episode
• Agentic Coding — 1× in this paper · explained in 1 episode
• Agentic System — 1× in this paper · explained in 2 episodes
• Annotator Agreement — 1× in this paper · explained in 1 episode
• Decoupling — 1× in this paper · explained in 2 episodes
• In International Conference on Learning Representations — 1× in this paper
• LLM judge — 1× in this paper · explained in 2 episodes
• Multi-Agent System — 1× in this paper · explained in 5 episodes
• Multi-agent Collaboration — 1× in this paper · explained in 2 episodes
• Robustness — 1× in this paper · explained in 5 episodes
• Verifier — 1× in this paper · explained in 2 episodes

Sources

• Defeating Prompt Injections by Design
• SkillProbe: Security Auditing for Emerging Agent Skill Marketplaces via Multi-Agent Collaboration
• Defending Against Indirect Prompt Injection Attacks With Spotlighting
• SkillJect: Effectively Automating Skill-Based Prompt Injection for Skill-Enabled Agents
• Kimi K2.5: Visual Agentic Intelligence
• SHADE-Arena: Evaluating Sabotage and Monitoring in LLM Agents
• STAC: When Innocent Tools Form Dangerous Chains for LLM Agents
• AgentDoG: A Diagnostic Guardrail Framework for AI Agent Safety and Security
• "Do Not Mention This to the User": Detecting and Understanding Malicious Agent Skills in the Wild
• Agent Skills in the Wild: An Empirical Study of Security Vulnerabilities at Scale
• Prompt Injection Attacks on Agentic Coding Assistants: A Systematic Analysis of Vulnerabilities in Skills, Tools, and Protocol Ecosystems
• Supply-Chain Poisoning Attacks Against LLM Coding Agent Skill Ecosystems
• Agent Skills Enable a New Class of Realistic and Trivially Simple Prompt Injections
• Skill-Inject: Measuring Agent Vulnerability to Skill File Attacks
• Don't Let the Claw Grip Your Hand: A Security Analysis and Defense Framework for OpenClaw
• BadSkill: Backdoor Attacks on Agent Skills via Model-in-Skill Poisoning
• SkillTester: Benchmarking Utility and Security of Agent Skills
• Qwen3 Technical Report
• ClawGuard: A Runtime Security Framework for Tool-Augmented LLM Agents Against Indirect Prompt Injection

Related papers

• MAVEN-T: Reinforced Heterogeneous Distillation for Real-Time Multi-Agent Trajectory Prediction
• Model Discovery Agent: LLM-assisted Bayesian experiment design for data-efficient discovery of mechanistic world models
• Agents' Last Exam
• The Clinician's Veto: Navigating Trust, Liability, and Uncertainty in Autonomous AI Prescribing
• MindHelper: Closed-Loop Embodied Mental-State Reasoning for Precision Intervention
• Incumbent Advantage: Brand Bias and Cognitive Manipulation Dynamics in LLM Recommendation Systems