你的凭证如何被LLM智能体技能泄露：一项实证研究
How Your Credentials Are Leaked by LLM Agent Skills: An Empirical Study
AI总结：
首次大规模实证研究LLM智能体技能中的凭证泄露问题，通过分析170,226个技能样本，识别出520个受影响技能和10种泄露模式，发现76.3%的案例需跨模态分析，调试日志占73.5%的漏洞，89.6%的泄露凭证可立即利用。
摘要：
大型语言模型（LLM）智能体越来越依赖第三方技能，这些技能在特权执行环境中运行并经常处理敏感凭证，然而这些凭证如何被泄露仍 largely unexplored。为填补这一空白，我们首次对智能体技能中的凭证泄露进行了大规模实证研究。从SkillsMP（最大的开源技能市场）的170,226个工件中，通过分层随机抽样抽取了17,022个技能，并通过静态秘密提取（正则表达式和AST解析）、使用模拟凭证的动态沙箱测试以及交叉引用开发者意图与运行时行为对每个技能进行了分析。我们的分析识别出520个受影响技能，包含1,708个安全问题，并得出了10种泄露模式的分类。三个发现尤为突出。首先，76.3%的案例需要联合分析自然语言描述和编程逻辑，表明技能中的凭证暴露本质上是跨模态的。其次，调试日志占漏洞的73.5%，因为智能体框架将标准输出反馈到LLM上下文窗口，将常规调试转变为凭证暴露向量。第三，89.6%的泄露凭证可立即利用——92.5%在无需提升权限的常规执行中即可利用——且基于分叉的分发模型阻碍了修复，因为从107个上游仓库移除的秘密在50多个独立分叉中持续存在。经过负责任的披露，所有恶意技能已被移除，91.6%的硬编码案例已修复。我们发布了数据集、分类和检测管道，以支持未来的智能体安全研究。
英文摘要：
Large Language Model (LLM) agents increasingly rely on third-party skills that operate within privileged execution environments and routinely handle sensitive credentials, yet how these credentials are leaked remains largely unexplored. To fill this gap, we present the first large-scale empirical study on credential leakage in agent skills. From 170,226 artifacts on SkillsMP, the largest open-source skill marketplace, we sampled 17,022 skills via stratified random sampling and analyzed each through static secret extraction (regex and AST parsing), dynamic sandbox testing with mock credentials, and cross-referencing developer intent against runtime behavior. Our analysis identifies 520 affected skills containing 1,708 security issues, and yields a taxonomy of 10 leakage patterns. Three findings stand out. First, 76.3% of cases require jointly analyzing natural-language descriptions and programming logic, showing that credential exposure in skills is fundamentally cross-modal. Second, debug logging accounts for 73.5% of vulnerabilities because agent frameworks feed stdout into the LLM context window, turning routine debugging into a credential exposure vector. Third, 89.6% of leaked credentials are immediately exploitable -- 92.5% during routine execution without elevated privileges -- and the fork-based distribution model defeats remediation, as secrets removed from 107 upstream repositories persist across 50+ independent forks. Following responsible disclosure, all malicious skills have been removed and 91.6% of hardcoded cases remediated. We release our dataset, taxonomy, and detection pipeline to support future agent security research.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
