Pith. sign in

REVIEW 3 major objections 5 minor 1 cited by

Cloak and Detonate: Scanner Evasion and Dynamic Detection of Agent Skill Malware

T0 review · 3 major / 5 minor · reviewed 2026-07-12 · grok-4.5

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Appearance-based scanners for third-party agent skills are systematically bypassable by payload-preserving cloaks, so trust must rest on observed runtime effects.

desk verdict Strong first systematic attack on skill scanners plus a workable runtime detector; detection rates are real but path-exercise-conditional. read the letter →

arxiv 2607.02357 v2 pith:RUGNNXTN submitted 2026-07-02 cs.CR cs.SE

Zimo Ji , Congying Xu , Zongjie Li , Yudong Gao , Xin Wei , Shuai Wang , Shing-Chi Cheung This is my paper
classification cs.CRcs.SE
keywords LLMagentsagentskillssoftwaresupplychaindynamicanalysisinformation-flowtrackingevasionattacksskillscannerstaint
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

LLM coding agents install third-party skills that run with the agent's privileges, opening a supply-chain path to credential theft, source exfiltration, and backdoors. This paper shows that existing install-time skill scanners—pattern matching, LLM-as-judge, or hybrid—fail against adaptive evasions that keep the malicious behavior intact while changing how the payload looks. SkillCloak rewrites scanner-visible signals into equivalent forms and packs the real skill so it only reappears when the agent runs it; across eight scanners and 1,613 wild malicious skills, packing bypasses every scanner above 90%, and structural rewrites clear most static tools above 80% without destroying utility on production agents. The authors therefore build SkillDetonate, a sandbox auditor that re-injects instructions the skill materializes at runtime and tracks sensitive data with markers through the agent context, files, processes, and network. SkillDetonate detects 97% of controlled attacks at a 2% false-positive rate and about 87% of executable wild malicious skills, and it stays stable under the same cloaks that collapse static tools.

What carries the argument

SkillCloak is the payload-preserving evasion framework (Structural Obfuscation rewrites or disperses scanner signals; Self-Extracting Skill Packing hides the payload outside the scanner's view and rematerializes it at run time). SkillDetonate is the runtime auditor that pairs on-demand closure lift—feeding natural-language instructions the skill writes into its own tree back into the agent session—with marker-based taint that tracks sensitive reads across agent context, inode graphs, and network sinks under confidentiality and integrity policies.

What would settle it

Run SkillDetonate on a large set of cloaked wild skills that independently produce the expected exfiltration or integrity-violating syscalls under a force-execution harness; if detection falls far below the reported 87–97% while those syscalls still fire, the claim that OS-boundary behavioral auditing withstands the cloaks fails.

Watch

Extended reading notes

Core claim

Current skill auditors that judge install-time appearance are systematically defeatable by payload-preserving transforms: Self-Extracting Skill Packing bypasses every surveyed scanner at over 90%, and Structural Obfuscation exceeds 80% on most static scanners and reaches 96% on a hybrid scanner, while cloaked skills remain functional on Claude Code and Codex. A behavior-centric runtime auditor that decides from OS-boundary information-flow evidence recovers detection, reaching 97% at 2% false positives on SkillJect and 87% on executable wild skills, without collapsing under the cloaks.

Load-bearing premise

The sandboxed agent must actually follow the skill's malicious instructions so the attack produces OS-boundary effects; if the agent skips a branch, the environment is incomplete, or the skill steers away from the sandbox, there is nothing for the detector to judge.

Editorial extensions

If this is right

  • Install-time appearance checks cannot be the sole trust gate once adaptive authors can rewrite or stage payloads while preserving attack semantics.
  • Marketplaces and CI pipelines need a dynamic detonation path that observes OS-level effects before a skill is fully trusted.
  • Static scanners remain useful only as cheap hygiene pre-filters, not as decisive allow/block mechanisms.
  • Multi-stage packed skills require the auditor to re-inject runtime-generated instruction files into the same agent session.
  • False-positive control depends on sensitive-to-untrusted information-flow evidence rather than mere file or network contact.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Standardized agent sandboxes with canary credentials and mocked external services will become as central to skill security as instrumented malware sandboxes are for binaries.
  • Force-execution agents that drive every natural-language branch could close the dominant wild-miss mode without changing the detector's core logic.
  • The same packing and rewrite patterns are likely to transfer to other agent-extensibility formats that ship natural-language instructions plus code.
  • Post-install tree-integrity checks raise packing cost but leave structural obfuscation intact, so layered defense still needs a runtime stage.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper studies the security of third-party agent skills for LLM coding agents. It first introduces SkillCloak, a payload-preserving evasion framework with Structural Obfuscation (rewrite/disperse scanner signals) and Self-Extracting Skill (SFS) Packing (hide payload until runtime). On 1,613 in-the-wild malicious skills and eight/nine open-source scanners, SFS Packing achieves ≥90% bypass on every scanner and Structural Obfuscation often ≥80%, while SkillsBench shows no statistically detectable utility loss on Codex and Claude Code. Motivated by this, it proposes SkillDetonate, a sandboxed runtime auditor that uses on-demand closure lift (execute instructions materialized under the skill root) and marker-based taint (FUSE-planted #dataN markers plus eBPF inode-level graphs) under confidentiality/integrity policies. On SkillJect (with cloaked variants) it reports ~95–98% detection at 2% FPR and ~87% on a filtered MalSkillBench subset, remaining stable under SkillCloak; ablations isolate taint (FP control) vs. closure lift (packed multi-stage coverage).

Significance. If the results hold, the paper makes a timely and concrete contribution to an emerging supply-chain surface: agent skills as privileged, marketplace-distributed capability packages. The adversarial study is unusually strong for this niche—large real-world corpus, multiple deployed scanners, an independent evasion baseline (VulMask), and utility preservation on production agents—establishing that install-time appearance auditing is systematically insufficient under payload-preserving transforms. SkillDetonate’s designs (closure lift for staged skills; markers that make the LLM context taint-trackable without in-model instrumentation) are technically well-motivated adaptations of classical detonation/taint ideas to agent-mediated execution. Honest miss analysis and complementary ablations strengthen credibility. The work is significant for both marketplace operators and agent runtime designers even if dynamic coverage remains incomplete.

major comments (3)
  1. [Abstract; §V-A; Fig. 6; §VI-A; §VIII] Abstract, §V-A, Fig. 6, and §VIII: The headline claim that SkillDetonate “detects 97% of attacks at a 2% false-positive rate and sustains 87% detection on real-world malicious skills” is path-exercise-conditional. Fig. 6 shows the dominant wild-miss cause is “Payload not triggered” (agent reads but does not execute the malicious instruction), with environment dependency and timeouts secondary; §VI-A correctly calls natural-language coverage the deepest open problem. The measured numbers are still valuable, but the abstract/conclusion should state that rates are under a single sandboxed session with the reference agent and that non-execution leaves no OS-boundary evidence. Without that qualification, the stronger framing that behavior-centric auditing is the load-bearing defense overstates what the evaluation establishes.
  2. [§IV-B3; §V-A Table V; §III-D] §IV-B3 and §V-A (Table V): SkillDetonate’s detection evaluation uses opencode+DeepSeek as the reference agent, whereas RQ2 utility is measured on OpenAI Codex (GPT-5.4) and Claude Code (Sonnet 4.6). Compliance with staged/malicious natural-language instructions can differ across models and harnesses; if DeepSeek is more willing to follow decode-and-run or exfil steps, detection rates may be inflated relative to production agents that refuse or sanitize. At least a multi-agent detection sweep (or a clear argument that the reference stack is a conservative lower bound) is needed for the claim that SkillDetonate remains effective when skills are run as victims would run them.
  3. [§IV-B2; §IV-B3; §V-A] §IV-B2–3 and free configuration: Marker-based policies depend on the sensitive-file set, integrity allowlists, and egress allowlists. The paper treats these as configuration but does not report sensitivity of detection/FPR to reasonable allowlist choices (e.g., skills that legitimately call package managers or cloud APIs). A short sensitivity or default-policy study would show that the 2% FPR and high detection are not artifacts of an overly tight or loose policy tailored to SkillJect/MalSkillBench sinks.
minor comments (5)
  1. [Abstract; Table I; §III-C] Abstract says “eight scanners”; Table I and §III-C refer to nine surveyed/runnable scanners. Align the count and naming throughout.
  2. [§III-C; §IV-A] §III-C: “delopyed” → “deployed”; elsewhere “adversial” → “adversarial”. Light copy-edit pass recommended.
  3. [Fig. 4; Table III] Fig. 4 / Table III: Report absolute n per scanner (skills flagged pre-evasion) in the figure or caption so bypass rates are fully interpretable without reconstructing from finding counts.
  4. [§V-A] §V-A: The filter from 703 to 622 MalSkillBench skills (“executable ground truth… Linux-runnable effect”) is important; a short appendix listing exclusion categories would help reproducibility.
  5. [Table II; §III-C] Table II operator examples are useful; a one-line note on which operators fire most often on the 1,613 corpus would connect the design to the empirical bypass results.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: bypass and detection claims are empirical measurements against open-source scanners and external benchmarks, not results forced by definition or self-citation.

full rationale

The paper’s load-bearing chain is empirical, not definitional. RQ1 reports measured bypass rates of SkillCloak transforms against eight independently implemented open-source scanners on an IOC-materialized corpus; the metric is explicitly relative to pre-evasion findings (k/n of skills each scanner already flags), which is the standard design for an evasion study and does not force the post-cloak verdict. RQ2 measures utility on SkillsBench with production agents. RQ3–RQ4 evaluate SkillDetonate on SkillJect and executable MalSkillBench skills, with Cisco and a naive agent as baselines, VulMask as an independent evasion, and ablations that isolate taint vs. closure lift. Self-citations (e.g., the authors’ prior IPI systematizations) appear only in related-work situating and are not used to justify uniqueness, force an ansatz, or underwrite the detection numbers. Information-flow policies are configuration-driven OS-boundary rules, not parameters fitted to the reported test sets and then re-presented as predictions. The natural-language path-coverage limitation discussed in §V-A/§VI-A is a coverage/assumption risk, not circularity. Overall the derivation is self-contained against external tools and benchmarks.

Assumptions & free parameters 4 free parameters · 5 assumptions · 3 invented entities

This is an empirical systems-security paper. The central claims rest on a threat model (self-contained skill malware under faithful agent execution), scanner coverage gaps, and the premise that successful attacks leave OS-boundary information-flow evidence. Free parameters are operational thresholds and policy sets rather than fitted physical constants. Novel constructs are engineering mechanisms evaluated experimentally, not postulated particles; their support is the reported detection/bypass measurements, not independent external observation outside this study.

free parameters (4)
  • MaxSteps / operator escalation budget in Structural Obfuscation
    Algorithm 1 loops to MaxSteps and escalates operators until findings clear; the exact budget and operator ordering affect bypass completeness and are implementation choices.
  • Sensitive-file set, integrity allowlists, and egress allowlists
    SkillDetonate’s confidentiality/integrity findings are defined by configuration of sources and sinks; changing these policies changes what counts as malicious.
  • Per-skill runtime timeout (900 s) and evaluation harness limits
    Timeouts and single-session detonation bound observed behaviors; some misses are attributed to this resource choice.
  • LLM-judge evaluation subset size (100 skills) and agent/model stack (opencode+DeepSeek reference)
    Expensive judges and the detonation agent are fixed experimental choices that can move measured bypass and detection rates.
assumptions (5)
  • domain assumption Faithful-execution contract: the host agent follows markdown links, runs scripts/*, and sources shell fragments as instructed by the skill.
    Definition 1 and the adversary model require self-contained malicious behavior under this contract; if agents refuse or heavily sanitize, both attack utility and detonation coverage change.
  • domain assumption Deployed scanners inspect only a strict subset of the skill tree/file types (blind dirs/files), so relocating or rewriting surface form can silence findings without removing payload markers.
    Table I and §III-A motivate both Structural Obfuscation and SFS Packing from surveyed scanner blind spots.
  • domain assumption Successful skill malware must produce observable OS-boundary effects (sensitive reads, untrusted egress, untrusted writes/exec) even if install-time appearance is benign.
    Core defensive insight of §IV; SkillDetonate’s policies encode this as confidentiality/integrity information-flow checks.
  • ad hoc to paper Marker strings returned by FUSE for sensitive reads remain trackable through agent natural-language context and inode-level process graphs despite encoding transforms.
    §IV-B2’s marker-based taint design assumes markers are not stripped/ignored and that graph reconstruction recovers cross-process flow for base64/gzip/encryption.
  • standard math Standard dynamic-analysis and malware-evasion background (packing, taint, anti-sandbox limits) applies to the skill medium.
    Related work and discussion import classical undecidability/path-coverage limits; used as framing rather than proved here.
invented entities (3)
  • SkillCloak (Structural Obfuscation + SFS Packing)
    purpose: Generate payload-preserving evasive skill variants that clear install-time scanners while remaining functional on production agents.
    Framework introduced to measure scanner brittleness; support is the reported bypass and SkillsBench utility results, not an external natural phenomenon.
  • SkillDetonate (on-demand closure lift + marker-based taint)
    purpose: Runtime auditor that executes skills in a sandbox and judges OS-boundary information-flow evidence rather than install-time appearance.
    Primary defensive contribution; evidence is SkillJect/wild detection tables and ablations, internal to the paper’s experiments.
  • Skill runtime closure (install-time files plus runtime-materialized files under skill root, tracked by FUSE inode lineage)
    purpose: Define the monitored unit so multi-stage packed skills that write their own next instructions are still executed and observed.
    Definition 2 is paper-specific; ablation without closure lift collapses packed detection, which is internal experimental support.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Cloak and Detonate: Scanner Evasion and Dynamic Detection of Agent Skill Malware." pith.science (2026). https://pith.science/paper/RUGNNXTN

@misc{pith2026260702357,
  author       = {Pith},
  title        = {Pith review of: Cloak and Detonate: Scanner Evasion and Dynamic Detection of Agent Skill Malware},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/RUGNNXTN}},
  note         = {Machine review of arXiv:2607.02357}
}
read the original abstract

LLM coding agents increasingly rely on third-party agent skills from public marketplaces, which execute with the agent's privileges and create a software supply-chain attack surface: a malicious skill can steal credentials, exfiltrate source code, or install backdoors. Existing defenses use static skill scanners based on pattern matching or LLM-as-judge analysis, but it remains unclear whether they withstand adaptive evasions that preserve malicious behavior while changing payload appearance. This paper first presents an adversarial study of existing skill scanners through SkillCloak, a payload-preserving evasion framework that keeps the attack semantics intact while transforming their visible form. SkillCloak uses two complementary strategies: Structural Obfuscation, which rewrites visible payload indicators into semantically equivalent forms, and Self-Extracting Skill (SFS) Packing, which hides malicious components from the install-time view and restores them during agent execution. Across eight scanners and 1,613 in-the-wild malicious skills, SFS Packing bypasses every scanner at over 90%, while Structural Obfuscation bypasses over 80% on most static scanners and reaches 96% on a hybrid scanner, showing that appearance-based auditing is insufficient. Motivated by this finding, we propose SkillDetonate, a behavior-centric runtime auditor that executes skills in a sandbox and detects malicious effects through OS-boundary information-flow evidence rather than install-time appearance. SkillDetonate combines on-demand closure lift, which observes instructions materialized during execution, with marker-based taint analysis, which tracks sensitive-data flows across the agent context, files, processes, and network operations. The results show that SkillDetonate detects 97% of attacks at a 2% false-positive rate and sustains 87% detection on real-world malicious skills.

Figures

Figures reproduced from arXiv: 2607.02357 by the authors.

Figure 1
Figure 1. Overview of SKILLCLOAK and SKILLDETONATE. two production agents (Codex and Claude Code) with 1,613 in￾the-wild malicious skills. We propose SKILLCLOAK, a payload￾preserving evasion framework that adaptively transforms mali￾cious skills while preserving their malicious behavior. SKILLCLOAK operates on two complementary strategies (Section III). 1) Structural Obfuscation rewrites concrete payload indica￾tors (e.g., ma… view at source ↗
Figure 2
Figure 2. Overview of the Structural Obfuscation workflow. [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Overview of the SFS Packing workflow. payload from the scanner’s view entirely. It is the skill-level analogue of self-extracting (SFX) packing in binary malware: a packer seals the real payload inside a self-extracting archive that unpacks at runtime, so a static scan sees only a benign stub and an opaque blob, never the malicious code. The same idea applies here, except the unpacking is driven by the agent executi… view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: Results of SKILLCLOAK’s per-scanner bypass rate. our metric is relative to a baseline detection, so a dataset where every skill carries a real, independently confirmed finding gives each attack a genuine signal to nullify, and using real rather than synthetic skills sh…
Figure 5
Figure 5. Figure 5: Overview of SKILLDETONATE. context and opaque cross-process byte transforms, both judged by two information-flow policies at the OS boundary. B. Behavior-Centric Auditor: SKILLDETONATE SKILLDETONATE takes a suspicious skill as input and outputs a malicious or safe verd…
Figure 6
Figure 6. Figure 6: Root cause of missing in-the-wild malicious skills. [PITH_FULL_IMAGE:figures/full_fig_p009_6.png]

Review history (2 revisions) →

Discussion (0). Sign in to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. SkillSentry: Adaptive Honey Worlds for Dynamic Safety Testing of Agent Skills

    cs.CR 2026-08 conditional novelty 6.0 of 10

    An AI-skill safety scanner that runs skills with and without decoy resources and compares behavior to detect hidden, conditional malicious actions.

Reference graph

Works this paper leans on

68 extracted references · 18 linked inside Pith · cited by 1 Pith paper

  1. [1]

    SWE-bench: Can language models resolve real-world github issues?

    C. E. Jimenez, J. Yang, A. Wettig, S. Yao, K. Pei, O. Press, and K. Narasimhan, “SWE-bench: Can language models resolve real-world github issues?” inInternational Conference on Learning Representations (ICLR), 2024

    2024

  2. [2]

    Cybench: A framework for evaluating cybersecurity capabilities and risks of language models,

    A. K. Zhanget al., “Cybench: A framework for evaluating cybersecurity capabilities and risks of language models,” inInternational Conference on Learning Representations (ICLR), 2025

    2025

  3. [3]

    GPT-Driver: Learning to drive with GPT,

    J. Mao, Y . Qian, J. Ye, H. Zhao, and Y . Wang, “GPT-Driver: Learning to drive with GPT,”arXiv preprint arXiv:2310.01415, 2023

    arXiv 2023

  4. [4]

    Claude Code,

    Anthropic, “Claude Code,” https://code.claude.com/, 2026

    2026

  5. [5]

    Codex: AI coding partner from OpenAI,

    OpenAI, “Codex: AI coding partner from OpenAI,” https://openai.com/ codex/, 2026

    2026

  6. [6]

    Introducing agent skills,

    Anthropic, “Introducing agent skills,” https://www.anthropic.com/news/ skills, 2025

    2025

  7. [7]

    AI agents market report 2025–2030, by applica- tion, geo, tech,

    MarketsandMarkets, “AI agents market report 2025–2030, by applica- tion, geo, tech,” https://www.marketsandmarkets.com/Market-Reports/ ai-agents-market-15761548.html, 2025, report code TC 9264. Accessed 2026

    2025

  8. [8]

    Agent skills: A data-driven analysis of claude skills for extending large language model functionality,

    G. Ling, S. Zhong, and R. Huang, “Agent skills: A data-driven analysis of claude skills for extending large language model functionality,”arXiv preprint arXiv:2602.08004, 2026

    arXiv 2026

Show all 68 references
  1. [9]

    ClawHavoc: 341 malicious Clawed skills found by the bot they were targeting,

    Koi Security, “ClawHavoc: 341 malicious Clawed skills found by the bot they were targeting,” https://www.koi.ai/blog/ clawhavoc-341-malicious-clawedbot-skills-found-by-the-bot-they-were-targeting, 2026, accessed 2026

    2026

  2. [10]

    How your credentials are leaked by LLM agent skills: An empirical study,

    Z. Chen and Y . Zhang, “How your credentials are leaked by LLM agent skills: An empirical study,”arXiv preprint arXiv:2604.03070, 2026

    2026 arXiv

  3. [11]

    Snyk finds prompt injection in 36%, 1467 malicious payloads in a ToxicSkills study of agent skills supply chain compromise,

    Snyk Security Labs, “Snyk finds prompt injection in 36%, 1467 malicious payloads in a ToxicSkills study of agent skills supply chain compromise,” https://snyk.io/blog/toxicskills-malicious-ai-agent-skills-clawhub/, 2026

    2026

  4. [12]

    Agent skills in the wild: An empirical study of security vulnerabilities at scale,

    Y . Liu and W. Wang, “Agent skills in the wild: An empirical study of security vulnerabilities at scale,”arXiv preprint arXiv:2601.10338, 2026

    2026 arXiv

  5. [13]

    “do not mention this to the user

    Y . Liu, Z. Chen, Y . Zhang, G. Deng, Y . Li, J. Ning, and L. Y . Zhang, ““do not mention this to the user”: Detecting and understanding malicious agent skills in the wild,”arXiv preprint arXiv:2602.06547, 2026

    2026 arXiv

  6. [14]

    SkillSieve: A hierarchical triage framework for detecting malicious AI agent skills,

    Y . Hou, Z. Yang, Z. Pang, and X. Ma, “SkillSieve: A hierarchical triage framework for detecting malicious AI agent skills,”arXiv preprint arXiv:2604.06550, 2026

    2026 arXiv

  7. [15]

    CASCADE: A cascaded hybrid defense architecture for prompt-injection detection in MCP-based systems,

    ˙I. A. Turgut and E. Gümü¸ s, “CASCADE: A cascaded hybrid defense architecture for prompt-injection detection in MCP-based systems,”arXiv preprint arXiv:2604.17125, 2026

    2026 arXiv

  8. [16]

    "elementary, my dear watson

    S. Wang and J. He, “"elementary, my dear watson." detecting malicious skills via neuro-symbolic reasoning across heterogeneous artifacts,”arXiv preprint arXiv:2603.27204, 2026

    2026

  9. [17]

    GitHub – openclaw/skills: All versions of all skills that are on clawhub.com archived · GitHub,

    OpenClaw, “GitHub – openclaw/skills: All versions of all skills that are on clawhub.com archived · GitHub,” https://github.com/openclaw/skills, 2026, public archive of all skills published to ClawHub, including malicious skills removed from the live marketplace. Archived snap-...

    2026

  10. [18]

    SkillJect: Effectively automating skill-based prompt injection for skill- enabled agents,

    X. Jia, J. Liao, S. Qin, J. Gu, W. Ren, X. Cao, Y . Liu, and P. Torr, “SkillJect: Effectively automating skill-based prompt injection for skill- enabled agents,”arXiv preprint arXiv:2602.14211, 2026

    2026 arXiv

  11. [19]

    MalSkillBench: A runtime-verified benchmark of malicious agent skills,

    W. Guo, W. Zeng, C. Liu, X. Jia, Y . Xu, L. Tang, Y . Fang, and Y . Liu, “MalSkillBench: A runtime-verified benchmark of malicious agent skills,” arXiv preprint arXiv:2606.07131, 2026

    2026 arXiv

  12. [20]

    Skill-Inject: Measuring agent vulnerability to skill file attacks,

    D. Schmotz, L. Beurer-Kellner, S. Abdelnabi, and M. Andriushchenko, “Skill-Inject: Measuring agent vulnerability to skill file attacks,”arXiv preprint arXiv:2602.20156, 2026

    2026 arXiv

  13. [21]

    Supply-chain poisoning attacks against LLM coding agent skill ecosystems,

    Y . Qu and Y . Liu, “Supply-chain poisoning attacks against LLM coding agent skill ecosystems,”arXiv preprint arXiv:2604.03081, 2026

    2026 arXiv

  14. [22]

    skill-security-scan,

    HuiFer, “skill-security-scan,” https://github.com/huifer/skill-security-scan, 2026

    2026

  15. [23]

    vigile-scan,

    Vigile.dev, “vigile-scan,” https://github.com/Vigile-ai/vigile-scan, 2026

    2026

  16. [24]

    SkillFortify: Formal capability verification for agent skills,

    V . P. Bhardwaj, “SkillFortify: Formal capability verification for agent skills,” https://github.com/qualixar/skillfortify, 2026

    2026

  17. [25]

    skill-audit,

    M. Pors, “skill-audit,” https://github.com/pors/skill-audit, 2026

    2026

  18. [26]

    agent-audit,

    HeadyZhang, “agent-audit,” https://github.com/HeadyZhang/agent-audit, 2026

    2026

  19. [27]

    Skillscanner,

    G. Patidar, “Skillscanner,” https://github.com/patidarganesh/SkillScanner, 2026

    2026

  20. [28]

    caterpillar,

    Alice IO, “caterpillar,” https://github.com/alice-dot-io/caterpillar, 2026

    2026

  21. [29]

    Cisco AI defense skill scanner,

    Cisco AI Defense, “Cisco AI defense skill scanner,” https://github.com/ cisco-ai-defense/skill-scanner, 2026

    2026

  22. [30]

    nova-proximity,

    T. Roccia, “nova-proximity,” https://github.com/fr0gger/proximity, 2026

    2026

  23. [31]

    Code obfuscation techniques for metamorphic viruses,

    J.-M. Borello and L. Mé, “Code obfuscation techniques for metamorphic viruses,”Journal in Computer Virology, vol. 4, no. 3, pp. 211–220, 2008

    2008

  24. [32]

    PhantomSkill: Malicious code injection in agent skill ecosystems,

    Y .-T. Lin and C.-M. Yu, “PhantomSkill: Malicious code injection in agent skill ecosystems,”arXiv preprint arXiv:2606.19191, 2026

    2026 arXiv

  25. [33]

    SkillsBench: Benchmarking how well agent skills work across diverse tasks,

    X. Liet al., “SkillsBench: Benchmarking how well agent skills work across diverse tasks,”arXiv preprint arXiv:2602.12670, 2026

    2026 arXiv

  26. [34]

    Backstabber’s knife collection: A review of open source software supply chain attacks,

    M. Ohm, H. Plate, A. Sykosch, and M. Meier, “Backstabber’s knife collection: A review of open source software supply chain attacks,” inDetection of Intrusions and Malware, and Vulnerability Assessment (DIMVA), 2020

    2020

  27. [35]

    Detecting environment-sensitive malware,

    M. Lindorfer, C. Kolbitsch, and P. M. Comparetti, “Detecting environment-sensitive malware,” inInternational Symposium on Recent Advances in Intrusion Detection (RAID), 2011

    2011

  28. [36]

    BareCloud: Bare-metal analysis- based evasive malware detection,

    D. Kirat, G. Vigna, and C. Kruegel, “BareCloud: Bare-metal analysis- based evasive malware detection,” inUSENIX Security Symposium, 2014, pp. 287–301

    2014

  29. [37]

    X-Force: Force- executing binary programs for security applications,

    F. Peng, Z. Deng, X. Zhang, D. Xu, Z. Lin, and Z. Su, “X-Force: Force- executing binary programs for security applications,” inUSENIX Security Symposium, 2014, pp. 829–844

    2014

  30. [38]

    Computer viruses: Theory and experiments,

    F. Cohen, “Computer viruses: Theory and experiments,”Computers & Security, vol. 6, no. 1, pp. 22–35, 1987

    1987

  31. [39]

    Semantics-aware malware detection,

    M. Christodorescu, S. Jha, S. A. Seshia, D. Song, and R. E. Bryant, “Semantics-aware malware detection,” inIEEE Symposium on Security and Privacy (S&P), 2005

    2005

  32. [40]

    Not what you’ve signed up for: Compromising real-world LLM- integrated applications with indirect prompt injection,

    K. Greshake, S. Abdelnabi, S. Mishra, C. Endres, T. Holz, and M. Fritz, “Not what you’ve signed up for: Compromising real-world LLM- integrated applications with indirect prompt injection,” inProceedings of the 16th ACM Workshop on Artificial Intelligence and Security (AISec), 2023

    2023

  33. [41]

    InjecAgent: Benchmarking indirect prompt injections in tool-integrated large language model agents,

    Q. Zhan, Z. Liang, Z. Ying, and D. Kang, “InjecAgent: Benchmarking indirect prompt injections in tool-integrated large language model agents,” inFindings of the Association for Computational Linguistics (ACL), 2024

    2024

  34. [42]

    AgentDojo: A dynamic environment to evaluate prompt injection attacks and defenses for LLM agents,

    E. Debenedetti, J. Zhang, M. Balunovi ´c, L. Beurer-Kellner, M. Fischer, and F. Tramèr, “AgentDojo: A dynamic environment to evaluate prompt injection attacks and defenses for LLM agents,” inAdvances in Neural Information Processing Systems (NeurIPS) Datasets and Benchmarks Tr...

    2024

  35. [43]

    Progent: Securing AI agents with privilege control,

    T. Shiet al., “Progent: Securing AI agents with privilege control,”arXiv preprint arXiv:2504.11703, 2025

    2025 arXiv

  36. [44]

    AgentSpec: Customizable runtime enforcement for safe and reliable LLM agents,

    H. Wang, C. M. Poskitt, and J. Sun, “AgentSpec: Customizable runtime enforcement for safe and reliable LLM agents,” inProceedings of the 48th International Conference on Software Engineering (ICSE), 2026

    2026

  37. [45]

    Contextual agent security: A policy for every purpose,

    L. Tsaiet al., “Contextual agent security: A policy for every purpose,” inWorkshop on Hot Topics in Operating Systems (HotOS), 2025

    2025

  38. [46]

    Defeating prompt injections by design,

    E. Debenedetti, I. Shumailov, T. Fan, J. Hayes, N. Carlini, D. Fabian, C. Kern, C. Shi, A. Terzis, and F. Tramèr, “Defeating prompt injections by design,”arXiv preprint arXiv:2503.18813, 2025

    2025 arXiv

  39. [47]

    RTBAS: Defending LLM agents against prompt injection and privacy leakage,

    P. Zhonget al., “RTBAS: Defending LLM agents against prompt injection and privacy leakage,”arXiv preprint arXiv:2502.08966, 2025

    2025 arXiv

  40. [48]

    Securing AI agents with information-flow control,

    M. Costa, B. Köpfet al., “Securing AI agents with information-flow control,”arXiv preprint arXiv:2505.23643, 2025

    2025 arXiv

  41. [49]

    IsolateGPT: An execution isolation architecture for LLM-based agentic systems,

    Y . Wu, F. Roesner, T. Kohno, N. Zhang, and U. Iqbal, “IsolateGPT: An execution isolation architecture for LLM-based agentic systems,” in Network and Distributed System Security Symposium (NDSS), 2025

    2025

  42. [50]

    Taxonomy, evaluation and exploitation of IPI-centric LLM agent defense frameworks,

    Z. Ji, X. Wang, Z. Li, P. Ma, Y . Gao, D. Wu, X. Yan, T. Tian, and S. Wang, “Taxonomy, evaluation and exploitation of IPI-centric LLM agent defense frameworks,”arXiv preprint arXiv:2511.15203, 2025

    2025

  43. [51]

    Taming various privilege escalation in LLM-based agent systems: A mandatory access control framework,

    Z. Ji, D. Wu, W. Jiang, P. Ma, Z. Li, Y . Gao, S. Wang, and Y . Li, “Taming various privilege escalation in LLM-based agent systems: A mandatory access control framework,”arXiv preprint arXiv:2601.11893, 2026

    2026

  44. [52]

    Optimization-based prompt injection attack to LLM-as-a-judge,

    J. Shi, Z. Yuan, Y . Liu, Y . Huang, P. Zhou, L. Sun, and N. Z. Gong, “Optimization-based prompt injection attack to LLM-as-a-judge,” inProceedings of the ACM SIGSAC Conference on Computer and Communications Security (CCS), 2024

    2024

  45. [53]

    Is LLM-as-a-judge robust? inves- tigating universal adversarial attacks on zero-shot LLM assessment,

    V . Raina, A. Liusie, and M. Gales, “Is LLM-as-a-judge robust? inves- tigating universal adversarial attacks on zero-shot LLM assessment,” inProceedings of the Conference on Empirical Methods in Natural Language Processing (EMNLP), 2024

    2024

  46. [54]

    The attacker moves second: Stronger adaptive attacks bypass defenses against LLM jailbreaks and prompt injections,

    M. Nasr, N. Carliniet al., “The attacker moves second: Stronger adaptive attacks bypass defenses against LLM jailbreaks and prompt injections,” arXiv preprint arXiv:2510.09023, 2025

    2025 arXiv

  47. [55]

    Bypassing LLM guardrails: An empirical analysis of evasion attacks against prompt injection and jailbreak detection systems,

    W. Hackettet al., “Bypassing LLM guardrails: An empirical analysis of evasion attacks against prompt injection and jailbreak detection systems,” inACL Workshop on Large Language Model Security (LLMSEC), 2025

    2025

  48. [56]

    An undetectable computer virus,

    D. M. Chess and S. R. White, “An undetectable computer virus,” in Proceedings of the Virus Bulletin Conference, 2000

    2000

  49. [57]

    Limits of static analysis for malware detection,

    A. Moser, C. Kruegel, and E. Kirda, “Limits of static analysis for malware detection,” in23rd Annual Computer Security Applications Conference (ACSAC), 2007

    2007

  50. [58]

    Learning to evade static PE machine learning malware models via reinforcement learning,

    H. S. Anderson, A. Kharkar, B. Filar, D. Evans, and P. Roth, “Learning to evade static PE machine learning malware models via reinforcement learning,”arXiv preprint arXiv:1801.08917, 2018

    2018 arXiv

  51. [59]

    Intriguing properties of adversarial ML attacks in the problem space,

    F. Pierazzi, F. Pendlebury, J. Cortellazzi, and L. Cavallaro, “Intriguing properties of adversarial ML attacks in the problem space,” inIEEE Symposium on Security and Privacy (S&P), 2020

    2020

  52. [60]

    Dynamic taint analysis for automatic detection, analysis, and signature generation of exploits on commodity software,

    J. Newsome and D. Song, “Dynamic taint analysis for automatic detection, analysis, and signature generation of exploits on commodity software,” inNetwork and Distributed System Security Symposium (NDSS), 2005

    2005

  53. [61]

    Dytan: A generic dynamic taint analysis framework,

    J. Clause, W. Li, and A. Orso, “Dytan: A generic dynamic taint analysis framework,” inInternational Symposium on Software Testing and Analysis (ISSTA), 2007

    2007

  54. [62]

    libdft: Practical dynamic data flow tracking for commodity systems,

    V . P. Kemerlis, G. Portokalidis, K. Jee, and A. D. Keromytis, “libdft: Practical dynamic data flow tracking for commodity systems,” in ACM SIGPLAN/SIGOPS International Conference on Virtual Execution Environments (VEE), 2012

    2012

  55. [63]

    Panorama: Capturing system-wide information flow for malware detection and analysis,

    H. Yin, D. Song, M. Egele, C. Kruegel, and E. Kirda, “Panorama: Capturing system-wide information flow for malware detection and analysis,” inACM Conference on Computer and Communications Security (CCS), 2007

    2007

  56. [64]

    TaintDroid: An information-flow tracking system for realtime privacy monitoring on smartphones,

    W. Enck, P. Gilbert, B.-G. Chun, L. P. Cox, J. Jung, P. McDaniel, and A. N. Sheth, “TaintDroid: An information-flow tracking system for realtime privacy monitoring on smartphones,” inUSENIX Symposium on Operating Systems Design and Implementation (OSDI), 2010

    2010

  57. [65]

    All you ever wanted to know about dynamic taint analysis and forward symbolic execution (but might have been afraid to ask),

    E. J. Schwartz, T. Avgerinos, and D. Brumley, “All you ever wanted to know about dynamic taint analysis and forward symbolic execution (but might have been afraid to ask),” inIEEE Symposium on Security and Privacy (S&P), 2010

    2010

  58. [66]

    A sense of self for unix processes,

    S. Forrest, S. A. Hofmeyr, A. Somayaji, and T. A. Longstaff, “A sense of self for unix processes,” inIEEE Symposium on Security and Privacy (S&P), 1996

    1996

  59. [67]

    Intrusion detection using sequences of system calls,

    S. A. Hofmeyr, S. Forrest, and A. Somayaji, “Intrusion detection using sequences of system calls,”Journal of Computer Security, vol. 6, no. 3, pp. 151–180, 1998

    1998

  60. [68]

    eAudit: A fast, scalable and deployable audit data collection system,

    R. Sekaret al., “eAudit: A fast, scalable and deployable audit data collection system,” inIEEE Symposium on Security and Privacy (S&P), 2024

    2024

Pith tools

Reviewed July 12, 2026 · model on record in the stance chip above.