真实世界中的智能体技能：大规模安全漏洞实证研究
Agent Skills in the Wild: An Empirical Study of Security Vulnerabilities at Scale
AI总结：
研究揭示了智能体技能中普遍存在的安全漏洞，提出了一种多阶段检测框架，并展示了技能捆绑执行脚本与漏洞之间的显著关联。
摘要：
随着人工智能智能体框架的兴起，引入了智能体技能，即包含指令和可执行代码的模块化包，能够动态扩展智能体的能力。尽管这种架构能够实现强大的定制化，但技能的执行却伴随着隐含的信任和最小的审查，从而形成了一个显著但未被明确描述的攻击面。我们进行了首次大规模的实证安全分析，针对这一新兴生态系统，从两个主要市场中收集了42,447个技能，并系统分析了31,132个技能，使用SkillScan，一种集静态分析与基于LLM的语义分类于一体的多阶段检测框架。我们的发现揭示了普遍的安全风险：26.1%的技能至少包含一个漏洞，涵盖14种不同的模式，分布在四个类别中：提示注入、数据外泄、特权提升和供应链风险。数据外泄（13.3%）和特权提升（11.8%）最为普遍，而5.2%的技能表现出高严重性模式，强烈暗示恶意意图。我们发现捆绑可执行脚本的技能比仅含指令的技能更可能包含漏洞（OR=2.12，p<0.001）。我们的贡献包括：（1）基于8,126个漏洞技能得出的漏洞分类学；（2）经过验证的检测方法，实现了86.7%的精确率和82.5%的召回率；（3）一个开放数据集和检测工具包，以支持未来研究。这些结果表明，迫切需要基于能力的权限系统和在该攻击向量被进一步利用之前，强制性的安全审查。
英文摘要：
The rise of AI agent frameworks has introduced agent skills, modular packages containing instructions and executable code that dynamically extend agent capabilities. While this architecture enables powerful customization, skills execute with implicit trust and minimal vetting, creating a significant yet uncharacterized attack surface. We conduct the first large-scale empirical security analysis of this emerging ecosystem, collecting 42,447 skills from two major marketplaces and systematically analyzing 31,132 using SkillScan, a multi-stage detection framework integrating static analysis with LLM-based semantic classification. Our findings reveal pervasive security risks: 26.1% of skills contain at least one vulnerability, spanning 14 distinct patterns across four categories: prompt injection, data exfiltration, privilege escalation, and supply chain risks. Data exfiltration (13.3%) and privilege escalation (11.8%) are most prevalent, while 5.2% of skills exhibit high-severity patterns strongly suggesting malicious intent. We find that skills bundling executable scripts are 2.12x more likely to contain vulnerabilities than instruction-only skills (OR=2.12, p<0.001). Our contributions include: (1) a grounded vulnerability taxonomy derived from 8,126 vulnerable skills, (2) a validated detection methodology achieving 86.7% precision and 82.5% recall, and (3) an open dataset and detection toolkit to support future research. These results demonstrate an urgent need for capability-based permission systems and mandatory security vetting before this attack vector is further exploited.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
