mlsanityData to 14 Oct 2026

SkillSieve: A Hierarchical Triage Framework for Detecting Malicious AI Agent Skills

arXiv 2604.06550 ↗First posted 8 Apr 2026cs.CR cs.AIcited by 20

On the map: LLM agents and tool use → Agent threats, guardrails and governance

Abstract (arXiv)

Agent skills combine natural-language instructions with executable code while inheriting an agent's filesystem, credential, and network access. Attacks can span prose and files, whereas regex and code-only analyzers cover only one modality. SkillSieve applies three progressively deeper layers: recall-oriented regex, AST, and metadata triage; four parallel LLM security sub-tasks; and an independent three-model jury with debate on disagreement. We evaluate 49,592 real ClawHub skills, a 390-skill labeled benchmark, and 100 adversarial samples across five evasion techniques on a 440 USD ARM board. The full pipeline achieves F1 = 0.929 (precision 0.912, recall 0.945) at an average cost of 0.006 per skill. An optional XGBoost fast path reduces Layer-2/3 calls by 32% with a 1.7-point F1 decrease while preserving recall. On 52 Feishu/Lark packages, Layer 2 reclassifies 13 of 14 Layer-1 flags as safe after contextual analysis; we also deploy the system as a Feishu chat bot. Code, labels, and aggregate results are open-sourced.

Key facts. Cited by 20 papers in the map (data through 14 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 21 of its 49 references that are in the map. First posted on arXiv 8 Apr 2026.

Builds on

21 of 49 references.

Closest ancestors · 8

Same direction, newest first

  1. 2026Agent Audit: A Security Analysis System for LLM Agent Applications24 Mar
  2. 2026SkillProbe: Security Auditing for Emerging Agent Skill Marketplaces via Multi-Agent Collaboration22 Mar
  3. 2026Formal Analysis and Supply Chain Security for Agentic AI Skills27 Feb
  4. 2026SkillJect: Effectively Automating Skill-Based Prompt Injection for Skill-Enabled Agents15 Feb
  5. 2026Agent Skills in the Wild: An Empirical Study of Security Vulnerabilities at Scale15 Jan
  6. 2025From Prompt Injections to Protocol Exploits: Threats in LLM-Powered AI Agents Workflows29 Jun
  7. 2025Prompt Injection Attack to Tool Selection in LLM Agents28 Apr
  8. 2024Teams of LLM Agents can Exploit Zero-Day Vulnerabilities2 Jun

Other references · 13

  1. 2023Judging LLM-as-a-Judge with MT-Bench and Chatbot Arenacited by 8,626
  2. 2016XGBoost: A Scalable Tree Boosting Systemcited by 5,166
  3. 2023Improving Factuality and Reasoning in Language Models through Multiagent Debatecited by 1,784
  4. 2023FrugalGPT: How to Use Large Language Models While Reducing Cost and Improving Performancecited by 853
  5. 2024The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructionscited by 493
  6. 2024Cybench: A Framework for Evaluating Cybersecurity Capabilities and Risks of Language Modelscited by 164
  7. 2026Agent Skills for Large Language Models: Architecture, Acquisition, Security, and the Path Forwardcited by 113
  8. 2024We Have a Package for You! A Comprehensive Analysis of Package Hallucinations by Code Generating LLMscited by 65
  9. 2020Backstabber's Knife Collection: A Review of Open Source Software Supply Chain Attackscited by 61
  10. 2026SkillTester: Benchmarking Utility and Security of Agent Skillscited by 10
  11. 2025Malware Detection at the Edge with Lightweight LLMs: A Performance Evaluationcited by 4
  12. 2026Latent Reuse in Agent Skills: Multi-modal Clone Detection at Ecosystem Scalecited by 4
1 more
  1. 2026LoRA-based Parameter-Efficient LLMs for Continuous Learning in Edge-based Malware Detectioncited by 1

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 20.

20 papers.

Sort:

By area:

  1. 2026When Safe Skills Collide: Measuring Compositional Risk in Agent Skill Ecosystemscited by 17
  2. 2026From Skill Text to Skill Structure: The Scheduling-Structural-Logical Representation for Agent Skillscited by 16
  3. 2026Benign in Isolation, Harmful in Composition: Security Risks in Agent Skill Ecosystemscited by 13
  4. 2026Under the Hood of SKILL.md: Semantic Supply-chain Attacks on AI Agent Skill Registrycited by 12
  5. 2026Cloak and Detonate: Scanner Evasion and Dynamic Detection of Agent Skill Malwarecited by 10
  6. 2026Behavioral Integrity Verification for AI Agent Skillscited by 7
  7. 2026Exploiting LLM Agent Supply Chains via Payload-less Skillscited by 6
  8. 2026SkillGuard: A Permission-Centric Framework for Agent Skill Securitycited by 6
  9. 2026Dynamic Agent Skills: A Lifecycle Survey and Taxonomy of Evolving Skill Librariescited by 6
  10. 2026ColluSkill: Adversarial Cross-Skill Composition for Evading Agent Skill Scannerscited by 4
  11. 2026Benchmarking Security Risk Detection and Verification in Open Agentic Skill Ecosystemscited by 2
  12. 2026SkillConsist: Detecting Inconsistencies in Agent Skills via Bidirectional Graph Alignmentcited by 1
8 more
  1. 2026Auto-Policy, not Auto-Skill: Compiled Agent Skills for the Physical Worldcited by 1
  2. 2026Towards a Systems Foundation for Agentic Skills: Architecture, Lifecycle, and Securitycited by 0
  3. 2026SkillSecurer: Detecting and Patching Prompt-Injection Vulnerabilities in AI Agent Skillscited by 0
  4. 2026SKILLLITE: Evidence-Guided Malicious Skill Auditing with Compact LLMscited by 0
  5. 2026Pretext: Defeating Malicious Skill Detection Frameworks for AI Agentscited by 0
  6. 2026MCRI: A Four-Dimensional Framework for Analyzing and Evaluating Agent Skillscited by 0
  7. 2026AgentSpy: Making AI Agent Behavior Observablecited by 0
  8. 2026Surviving the Router: Optimizing Skill Injections for Retrieval and Executioncited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026SkillsMetric: Mapping the Detection Boundary of Static Analysis for Malicious Agent Skills
  2. 2026MalSkillBench: A Runtime-Verified Benchmark of Malicious Agent Skills
  3. 2026MaliciousSkillBench: A Comprehensive Benchmark for Malicious Agent Skill Detection
  4. 2026Towards a Risk Assessment of Malicious Skill Files in Coding Agents
  5. 2026SkillAtlas: An Attack Trace Library for Agent Skills
  6. 2026Detecting Malicious Agent Skills in the Wild using Attention
  7. 2026SkillScreen: High-Recall Screening of Malicious Agent Skills with Decision Models
  8. 2026"Do Not Mention This to the User": Detecting and Understanding Malicious Agent Skills in the Wild