Towards Secure Agent Skills: Architecture, Threat Taxonomy, and Security Analysis

Abstract:Agent Skills is an emerging open standard that defines a modular, filesystem-based packaging format enabling LLM-based agents to acquire domain-specific expertise on demand. Despite rapid adoption across multiple agentic platforms and the emergence of large community marketplaces, the security properties of Agent Skills have not been systematically studied. This paper presents a systematization of the security of the Agent Skills framework. We define a threat model for the framework and decompose the full lifecycle of an Agent Skill across four phases---Creation, Distribution, Deployment, and Execution---identifying the structural attack surface each phase introduces. Building on this lifecycle analysis, we construct a threat taxonomy comprising seven categories and nineteen scenarios organized across three attack layers, grounded in both architectural analysis and real-world evidence. Each scenario is annotated with whether the exposure follows from the specification or from the latitude the specification leaves to individual runtimes, with the strength of the public evidence supporting it, and with the feasibility of its mitigation. We map seven documented security incidents onto the taxonomy. Based on these findings, we discuss defense directions for each threat category, identify open research challenges, and provide actionable recommendations for stakeholders. The most severe threats arise from structural properties of the framework itself: the absence of a data-instruction boundary, a single-approval persistent trust model, and a capability declaration mechanism to which the specification attaches no enforcement semantics. None of these is addressable through incremental mitigations alone.

Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI)

arXiv:2604.02837 [cs.CR]

(or arXiv:2604.02837v2 [cs.CR] for this version)

https://doi.org/10.48550/arXiv.2604.02837 Focus to learn more arXiv-issued DOI via DataCite

arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.

Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.

Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.