mlsanityData to 7 Oct 2026

Formal Analysis and Supply Chain Security for Agentic AI Skills

arXiv 2603.00195 ↗First posted 27 Feb 2026cs.CR cs.AI cs.SEcited by 21

On the map: LLM agents and tool use → Agent threats, guardrails and governance

Abstract (arXiv)

32 pages, 5 theorems with full proofs, 68 references, open-source tool: https://github.com/qualixar/skillfortify. v2: corrects the bibliography (22 entries had author lists that did not match the papers at the cited arXiv identifiers; all verified against the arXiv API and corrected, and affected authors notified) and three external claims against primary sources: MalTool reports 1,300 standalone and 5,727 embedded malicious tools, not 6,487; CVE-2026-25253 is authentication-token exfiltration via an unvalidated gatewayUrl, credited to depthfirst and fixed in 2026.1.29, not remote code execution through a crafted skill package; ClawHavoc counts are 341, later 824, and 1,184 by source and date, not "over 1,200". All experiments re-measured against the released v0.6.0 implementation using harnesses now committed to the repository. E1/E2 unchanged (F1 96.15%). E3 reverses to a negative result: information flow analysis adds no detections over pattern matching on this corpus. The soundness theorem's scope is stated explicitly and no longer conflated with the zero false-positive rate.

Key facts. Cited by 21 papers in the map (data through 7 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 17 of its 97 references that are in the map. First posted on arXiv 27 Feb 2026.

Builds on

17 of 97 references.

Closest ancestors · 11

Same direction, newest first

  1. 2026Agent Behavioral Contracts: Formal Specification and Runtime Enforcement for Reliable Autonomous AI Agents25 Feb
  2. 2026The LLMbda Calculus: AI Agents, Conversations, and Information Flow23 Feb
  3. 2026CIBER: A Comprehensive Benchmark for Security Evaluation of Code Interpreter Agents23 Feb
  4. 2026OMNI-LEAK: Orchestrator Multi-Agent Network Induced Data Leakage13 Feb
  5. 2026Unsafer in Many Turns: Benchmarking and Defending Multi-Turn Safety Risks in Tool-Using Agents13 Feb
  6. 2026MalTool: Malicious Tool Attacks on LLM Agents12 Feb
  7. 2026Agent Skills in the Wild: An Empirical Study of Security Vulnerabilities at Scale15 Jan
  8. 2026Towards Verifiably Safe Tool Use for LLM Agents12 Jan
  9. 2025MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers19 Aug
  10. 2025MCPXKIT: The Unified Toolkit for Analyzing Model Context Protocol Security18 Aug
  11. 2025Extending the OWASP Multi-Agentic System Threat Modeling Guide: Insights from Multi-Agent Security Research13 Aug

Other references · 6

  1. 2026SoK: Agentic Skills -- Beyond Tool Use in LLM Agentscited by 120
  2. 2020Backstabber's Knife Collection: A Review of Open Source Software Supply Chain Attackscited by 57
  3. 2023LLM Platform Security: Applying a Systematic Evaluation Framework to OpenAI's ChatGPT Pluginscited by 49
  4. 2026Capable but Unreliable: Canonical Path Deviation as a Causal Mechanism of Agent Failure in Long-Horizon Taskscited by 5
  5. 2025A Rusty Link in the AI Supply Chain: Detecting Evil Configurations in Model Repositoriescited by 2
  6. 2026Package Managers `a la Carte: A Formal Model of Dependency Resolutioncited by 1

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2026: 21.

21 papers.

Sort:

By area:

  1. 2026SkillSieve: A Hierarchical Triage Framework for Detecting Malicious AI Agent Skillscited by 18
  2. 2026How Your Credentials Are Leaked by LLM Agent Skills: An Empirical Studycited by 14
  3. 2026When Safe Skills Collide: Measuring Compositional Risk in Agent Skill Ecosystemscited by 14
  4. 2026MalSkillBench: A Runtime-Verified Benchmark of Malicious Agent Skillscited by 14
  5. 2026Context Matters: Repository-Aware Security Analysis of the Agent Skill Ecosystemcited by 10
  6. 2026Benign in Isolation, Harmful in Composition: Security Risks in Agent Skill Ecosystemscited by 9
  7. 2026Behavioral Integrity Verification for AI Agent Skillscited by 6
  8. 2026Seeing Is Not Screening: Multimodal Hidden Instruction Attacks on Agent Skill Scannerscited by 5
  9. 2026Agent Skill Security: Threat Models, Attacks, Defenses, and Evaluationcited by 4
  10. 2026Agent Skills Matter: Inferring Proprietary Skills from Execution Trajectoriescited by 4
  11. 2026The Y-Combinator for LLMs: Solving Long-Context Rot with λ-Calculuscited by 3
  12. 2026Skills Are Not Islands: Measuring Dependency and Risk in Agent Skill Supply Chainscited by 3
9 more
  1. 2026ColluSkill: Adversarial Cross-Skill Composition for Evading Agent Skill Scannerscited by 3
  2. 2026AgentAssay: Token-Efficient Regression Testing for Non-Deterministic AI Agent Workflowscited by 2
  3. 2026Runtime Skill Audit: Targeted Runtime Probing for Agent Skill Securitycited by 2
  4. 2026Protocol-Level Attacks on Agentic Commerce Platforms: A Cross-Platform Taxonomy, AIP-Bench, and Unified Defensecited by 1
  5. 2026Understanding and mitigating the risks of OpenClaw for non-technical users: A practical guide with Skillcited by 0
  6. 2026SynChain: Inducing Computer-Use Agent Systems to Construct Their Own Attack Chainscited by 0
  7. 2026MaliciousSkillBench: A Comprehensive Benchmark for Malicious Agent Skill Detectioncited by 0
  8. 2026Versioned Transitive Dependency-Closure Binding and Operation-Time Effect Governance for Agent Skills: ClosureBoundcited by 0
  9. 2026MMSkillRisk: Can Agents Stay Safe When Multimodal Skills Become Traps?cited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026SkillGate: Cost Efficient Runtime Malicious Skill File Detection in Coding Agents
  2. 2026ClawHub Security Signals: When VirusTotal, Static Analysis, and SkillSpector Disagree
  3. 2026SkillSecurer: Detecting and Patching Prompt-Injection Vulnerabilities in AI Agent Skills
  4. 2026Benchmarking Security Risk Detection and Verification in Open Agentic Skill Ecosystems
  5. 2026SkillsMetric: Mapping the Detection Boundary of Static Analysis for Malicious Agent Skills
  6. 2026SKILLLITE: Evidence-Guided Malicious Skill Auditing with Compact LLMs
  7. 2026Skill-Inject: Measuring Agent Vulnerability to Skill File Attacks
  8. 2026SkillJect: Effectively Automating Skill-Based Prompt Injection for Skill-Enabled Agents