[2602.06547] "Do Not Mention This to the User": Detecting and Understanding Malicious Agent Skills in the Wild

Skip to main content

arXiv is now an independent nonprofit!<br>Learn more<br>&times;

Search arXiv

Press Enter to search &middot; Advanced search

-->

Computer Science > Cryptography and Security

arXiv:2602.06547 (cs)

[Submitted on 6 Feb 2026 (v1), last revised 10 Jun 2026 (this version, v4)]

Title:"Do Not Mention This to the User": Detecting and Understanding Malicious Agent Skills in the Wild

Authors:Yi Liu, Zhihao Chen, Yanjun Zhang, Gelei Deng, Yuekang Li, Jianting Ning, Leo Yu Zhang<br>View a PDF of the paper titled "Do Not Mention This to the User": Detecting and Understanding Malicious Agent Skills in the Wild, by Yi Liu and 5 other authors

View PDF<br>HTML (experimental)

Abstract:LLM-based coding agents increasingly rely on third-party extensions called skills, which bundle natural language instructions and helper scripts that execute with full user privileges. Community registries have emerged to distribute these skills, but the security implications remain unstudied due to the absence of labeled threat data. This paper presents a systematic security analysis of 98,380 skills collected from two major registries. Through a combination of static pattern matching and dynamic behavioral verification, we identify 157 skills exhibiting confirmed malicious behavior, encompassing 632 distinct vulnerabilities across 13 attack techniques. Our analysis reveals that these threats are deliberate rather than accidental: each malicious skill contains an average of 4.03 vulnerabilities spanning multiple attack phases. We identify two dominant attack strategies with statistically significant negative correlation -- credential theft via remote code execution, and agent manipulation through adversarial instructions embedded in documentation. Over half of all confirmed cases originate from a single threat actor employing templated brand impersonation at scale. We further observe that attack sophistication correlates with concealment investment, with advanced skills universally employing undocumented capabilities while also exploiting platform-native trust mechanisms. Following responsible disclosure, registry maintainers removed all 157 (100%) of the reported skills. Our dataset and detection pipeline are publicly available to facilitate future research on securing LLM agent ecosystems.

Comments:<br>Accepted to the 35th USENIX Security Symposium (USENIX Security 2026)

Subjects:

Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI); Computation and Language (cs.CL); Emerging Technologies (cs.ET)

Cite as:<br>arXiv:2602.06547 [cs.CR]

(or<br>arXiv:2602.06547v4 [cs.CR] for this version)

https://doi.org/10.48550/arXiv.2602.06547

Focus to learn more

arXiv-issued DOI via DataCite

Submission history<br>From: Yi Liu [view email]<br>[v1]<br>Fri, 6 Feb 2026 09:52:27 UTC (176 KB)

[v2]<br>Sat, 14 Mar 2026 01:34:44 UTC (176 KB)

[v3]<br>Mon, 1 Jun 2026 13:03:27 UTC (176 KB)

[v4]<br>Wed, 10 Jun 2026 03:31:37 UTC (178 KB)

Full-text links:<br>Access Paper:

View a PDF of the paper titled "Do Not Mention This to the User": Detecting and Understanding Malicious Agent Skills in the Wild, by Yi Liu and 5 other authors<br>View PDF<br>HTML (experimental)<br>TeX Source

view license

Current browse context:

cs.CR

next >

new<br>recent<br>| 2026-02

Change to browse by:

cs<br>cs.AI<br>cs.CL<br>cs.ET

References & Citations

NASA ADS<br>Google Scholar

Semantic Scholar

export BibTeX citation<br>Loading...

BibTeX formatted citation

&times;

loading...

Data provided by:

Bookmark

Bibliographic Tools

Bibliographic and Citation Tools

Bibliographic Explorer Toggle

Bibliographic Explorer (What is the Explorer?)

Connected Papers Toggle

Connected Papers (What is Connected Papers?)

Litmaps Toggle

Litmaps (What is Litmaps?)

scite.ai Toggle

scite Smart Citations (What are Smart Citations?)

Code, Data, Media

Code, Data and Media Associated with this Article

alphaXiv Toggle

alphaXiv (What is alphaXiv?)

Links to Code Toggle

CatalyzeX Code Finder for Papers (What is CatalyzeX?)

DagsHub Toggle

DagsHub (What is DagsHub?)

GotitPub Toggle

Gotit.pub (What is GotitPub?)

Huggingface Toggle

Hugging Face (What is Huggingface?)

ScienceCast Toggle

ScienceCast (What is ScienceCast?)

Demos

Demos

Replicate Toggle

Replicate (What is Replicate?)

Spaces Toggle

Hugging Face Spaces (What is Spaces?)

Spaces Toggle

TXYZ.AI (What is TXYZ.AI?)

Related Papers

Recommenders and Search Tools

Link to Influence Flower

Influence Flower (What are Influence Flowers?)

Core recommender toggle

CORE Recommender (What is CORE?)

Author

Venue

Institution

Topic

About arXivLabs

arXivLabs: experimental projects with community collaborators

arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.

Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community,...