# Pretext: Defeating Malicious Skill Detection Frameworks for AI Agents

arXiv: https://arxiv.org/abs/2609.39607 · HTML: https://mlsanity.com/paper/2609.39607/

## Key facts

- No citing papers in the map yet (data through 7 Oct 2026).
- Placed in Agent skill learning and evolution, one of 16 directions in LLM agents and tool use.
- Builds on 9 of its 23 references that are in the map.
- First posted on arXiv 30 Sep 2026.

## Placed in

- LLM agents and tool use / [Agent skill learning and evolution](https://mlsanity.com/agents/agent-skill-learning-and-evolution/)

## Builds on (most cited first, 9 of 9)

- ["Do Not Mention This to the User": Detecting and Understanding Malicious Agent Skills in the Wild](https://mlsanity.com/paper/2602.06547/) (2026)
- [Supply-Chain Poisoning Attacks Against LLM Coding Agent Skill Ecosystems](https://mlsanity.com/paper/2604.03081/) (2026)
- [SkillAttack: Automated Red Teaming of Agent Skills through Attack Path Refinement](https://mlsanity.com/paper/2604.04989/) (2026)
- [SkillTrojan: Backdoor Attacks on Skill-Based Agent Systems](https://mlsanity.com/paper/2604.06811/) (2026)
- [SkillJect: Effectively Automating Skill-Based Prompt Injection for Skill-Enabled Agents](https://mlsanity.com/paper/2602.14211/) (2026)
- [SkillSieve: A Hierarchical Triage Framework for Detecting Malicious AI Agent Skills](https://mlsanity.com/paper/2604.06550/) (2026)
- [Defensive Refusal Bias: How Safety Alignment Fails Cyber Defenders](https://mlsanity.com/paper/2603.01246/) (2026)
- [Detecting Malicious Agent Skills in the Wild using Attention](https://mlsanity.com/paper/2606.23416/) (2026)
- [SkillGate: Cost Efficient Runtime Malicious Skill File Detection in Coding Agents](https://mlsanity.com/paper/2607.25619/) (2026)

## Abstract (arXiv)

Skills extend an agent's capabilities by injecting instructions and information into the context, and are widely used by agents such as OpenClaw and Claude Code. Prior work shows third-party marketplaces host malicious skills that give attackers direct influence over the victim's agent. The emerging defense scans skills before installation, pairing deterministic static checks with an LLM-based semantic judge, as in NVIDIA's SkillSpector. We show that such defenses fall to an attacker who knows the detector. Our white-box LLM attacker, Pretext, iteratively crafts skills that evade detection while still delivering the payload and performing the benign task: moving the payload from code into natural language leaves static analysis inert, while framing it as the skill's legitimate purpose and splitting instructions across files keeps the LLM stage below its blocking threshold. Across three open-source models, Pretext achieves up to 97% and 77% against a frozen detector and a co-adaptive one, respectively, revealing major gaps in current skill scanners.