cs.CR提交于 2026-10-31已译

安装前先扫描：检测与缓解技能中的本地及复合漏洞

Scan Before You Install: Detecting and Mitigating Local and Composite Vulnerabilities in Skills

Parth A. Gandhi · Avital Aviv · Prasanna N. Wudali · Yuval Elovici · Asaf Shabtai

中文摘要

Agent 技能（skill）打包自然语言指令、脚本和参考文件，供基于 LLM 的智能体在任务中加载。技能可在用户授权下访问文件系统、shell 和网络，其弱点可能导致不安全执行。现有扫描器主要针对恶意技能，而非公共仓库中非故意的漏洞，且孤立分析技能，忽视多技能交互。为此开发了六模块扫描器：内容提取、本地分析、复合分析、验证、报告与缓解。本地分析检测良性技能中的非故意漏洞。在 SkillTrustBench 的 556 例排行榜子集上，召回率 95.90%，误报率 4.22%；在 1,000 个 MalSkillBench 技能的平衡样本上，F1 为 0.947，优于 Cisco 的 Skill Scanner、NVIDIA 的 SkillSpector、AgentSkillsScanner 和 SkillSieve。在 75 个最高星 GitHub 仓库的 1,587 个技能中，三名分析师确认了 59 项发现中的 53 项（精确率 89.8%），涉及 23 个仓库。为每个漏洞开发了概念验证（PoC）攻击，向维护者披露了 10 个中高危案例，并在其余案例上测试了缓解措施。复合分析通过共享资源、调用和指令介导的交互对技能间依赖建模。在 SCR-Bench 上，F1 为 0.991（精确率 98.7%，召回率 99.6%），而 CompoSkill 发布的三种 SkillsGuard 配置为 0.816-0.858。在 GitHub 上识别出两项复合发现，经 PoC 攻击验证。缓解模块推荐技能替换、补丁和配置更改。对于 55 项 GitHub 发现中的 47 项，缓解措施在所有试验中阻止了 PoC 攻击，同时保留了测试的合法功能。

关键要点

01现有扫描器只针对恶意技能，忽略良性技能中的非故意漏洞及多技能交互。
02本地分析在 SkillTrustBench 子集召回 95.90%、误报 4.22%，MalSkillBench 上 F1 0.947。
03GitHub 1,587 个技能中确认 53/59 项发现，精确率 89.8%，披露 10 个中高危案例。
04复合分析在 SCR-Bench 上 F1 0.991，优于 SkillsGuard 配置的 0.816-0.858。
05缓解措施对 47/55 项发现阻止了 PoC 攻击，同时保留合法功能。

解读

尚无解读。

原始英文摘要

arXiv:2610.37901v1 Announce Type: cross Abstract: An agent skill packages natural-language instructions, scripts, and reference files that an LLM-based agent loads for a task. Skills may access the file system, shell, and network under user-authorized permissions; weaknesses can lead to unsafe execution. Existing scanners primarily target malicious skills, not unintended vulnerabilities in public repositories, and analyze skills in isolation, overlooking multi-skill interactions. To address these gaps, we developed a six-module scanner: Content Extraction, Local Analysis, Composite Analysis, Validation, Reporting, and Mitigation. Local Analysis detects unintended vulnerabilities in benign skills. On a 556-case leaderboard subset of SkillTrustBench, it achieved 95.90% recall with a 4.22% false positive rate; on a balanced sample of 1,000 MalSkillBench skills, its F1 was 0.947, outperforming Cisco's Skill Scanner, NVIDIA's SkillSpector, AgentSkillsScanner, and SkillSieve. In 1,587 skills from the 75 most-starred GitHub repositories, three analysts confirmed 53 of 59 findings (89.8% precision) across 23 repositories. We developed proof-of-concept (PoC) attacks for each vulnerability, disclosed 10 medium- and high-severity cases to maintainers, and tested mitigations on the remaining cases. Composite Analysis models dependencies among skills through shared resources, invocations, and instruction-mediated interactions. On SCR-Bench, its F1 score was 0.991 (98.7% precision, 99.6% recall), versus 0.816-0.858 for three SkillsGuard configurations released with CompoSkill. It identified two composite findings on GitHub, validated by PoC attacks. The Mitigation module recommends skill substitution, patches, and configuration changes. For 47 of 55 GitHub findings, mitigations prevented PoC attacks in all trials while preserving tested legitimate functionality.