Understanding and Mitigating Cross-Session Attacks via Persistent Artifacts in Agent Skill Composition
cs.CR, cs.SE
Submitted: 2026-10-09
Updated: 2026-10-09
Code: https://github.com/Dianshu-Liao/SkillRelay
License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
Sources
- When Experience Becomes Instruction: Trajectory Poisoning in Self-Evolving Agent Skill Systems
- AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Bases
- How Your Credentials Are Leaked by LLM Agent Skills: An Empirical Study
- Securing AI Agents with Information-Flow Control
- Defeating Prompt Injections by Design
- AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents
- Memory Injection Attacks on LLM Agents via Query-Only Interaction
- Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection
- MalSkillBench: A Runtime-Verified Benchmark of Malicious Agent Skills
- Defending Against Indirect Prompt Injection Attacks With Spotlighting
- SkillSieve: A Hierarchical Triage Framework for Detecting Malicious AI Agent Skills
- Taming Various Privilege Escalation in LLM-Based Agent Systems: A Mandatory Access Control Framework
- SkillJect: Effectively Automating Skill-Based Prompt Injection for Skill-Enabled Agents
- Seeing Is Not Screening: Multimodal Hidden Instruction Attacks on Agent Skill Scanners
- AgentLAB: Benchmarking LLM Agents against Long-Horizon Attacks
- SoK: Agentic Skills -- Beyond Tool Use in LLM Agents
- SkillSafetyBench: Evaluating Agent Safety under Skill-Facing Attack Surfaces
- Understanding User Privacy Perceptions of GenAI Smartphones
- Prompt Flow Integrity to Prevent Privilege Escalation in LLM Agents
- SkillMutator: Benchmarking and Defending Language-and-Code Cross-modal Attacks on LLM Agent Skills
Related papers
- SoK: AI-Augmented Binary Reversing
- Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
- Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
- Efficient Fuzzy PSI under One-Sided Assumptions
- Sealing the Audit-Runtime Gap for LLM Skills
- Token Composition: A Graph Based on EVM Logs