“不要向用户提及此事”：检测与理解恶意代理技能
"Do Not Mention This to the User": Detecting and Understanding Malicious Agent Skills in the Wild
AI总结：
本文通过对两个主要注册中心的98,380个技能进行系统安全分析，结合静态模式匹配和动态行为验证，识别出157个恶意技能，揭示了13种攻击技术中的632个不同漏洞，并发现攻击复杂性与隐藏投入相关。
摘要：
基于LLM的编码代理越来越依赖称为技能的第三方扩展，这些技能捆绑了自然语言指令和辅助脚本，以完全用户权限执行。社区注册中心已出现以分发这些技能，但由于缺乏标记的威胁数据，安全影响仍未得到研究。本文对从两个主要注册中心收集的98,380个技能进行了系统安全分析。通过静态模式匹配和动态行为验证的结合，我们识别出157个表现出确认恶意行为的技能，涵盖13种攻击技术中的632个不同漏洞。我们的分析表明，这些威胁是故意的而非偶然：每个恶意技能平均包含4.03个漏洞，跨越多个攻击阶段。我们识别出两种具有统计显著负相关的主要攻击策略——通过远程代码执行窃取凭证，以及通过嵌入文档中的对抗性指令操纵代理。超过一半的确认案例来自一个采用模板化品牌冒充大规模攻击的单一威胁行为者。我们进一步观察到，攻击复杂性与隐藏投入相关，高级技能普遍使用未记录的功能，同时利用平台原生的信任机制。在负责任的披露之后，注册中心维护者删除了所有157个（100%）报告的技能。我们的数据集和检测管道公开可用，以促进未来关于保护LLM代理生态系统安全的研究。
英文摘要：
LLM-based coding agents increasingly rely on third-party extensions called skills, which bundle natural language instructions and helper scripts that execute with full user privileges. Community registries have emerged to distribute these skills, but the security implications remain unstudied due to the absence of labeled threat data. This paper presents a systematic security analysis of 98,380 skills collected from two major registries. Through a combination of static pattern matching and dynamic behavioral verification, we identify 157 skills exhibiting confirmed malicious behavior, encompassing 632 distinct vulnerabilities across 13 attack techniques. Our analysis reveals that these threats are deliberate rather than accidental: each malicious skill contains an average of 4.03 vulnerabilities spanning multiple attack phases. We identify two dominant attack strategies with statistically significant negative correlation -- credential theft via remote code execution, and agent manipulation through adversarial instructions embedded in documentation. Over half of all confirmed cases originate from a single threat actor employing templated brand impersonation at scale. We further observe that attack sophistication correlates with concealment investment, with advanced skills universally employing undocumented capabilities while also exploiting platform-native trust mechanisms. Following responsible disclosure, registry maintainers removed all 157 (100%) of the reported skills. Our dataset and detection pipeline are publicly available to facilitate future research on securing LLM agent ecosystems.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
