代理能否信任其技能？揭示基于技能的LLM代理中的不安全信任链
Can Agents Trust Their Skills? Uncovering Unsafe Chains of Trust in Skill-Based LLM Agents
浏览论文内容
中文总结 AI 辅助
本研究提出TrustProbe框架，通过分析源代码和演化测试，在11个开源LLM代理中发现104个污点式漏洞，表明技能内容可突破信任链危害安全敏感操作。
中文摘要 AI 辅助
LLM代理越来越依赖可安装的技能，这些技能是包含指令、代码和资源的软件包，为代理提供特定任务的能力，一旦安装，便可在后续用户任务中被自动调用。这形成了一个信任链：用户将权限委托给代理，而代理框架在验证不足的情况下将技能提供的内容纳入代理上下文，使得恶意技能能够在被委托的权限下影响代理行为。然而，关于这种信任模型在安全敏感操作之前是否能充分约束不受信任的技能内容，以及此类信任违规在现实代理中发生的频率，目前知之甚少。我们提出了TrustProbe，一个用于揭示基于技能的LLM代理中不安全信任链的框架。首先，TrustProbe分析代理源代码，以识别从技能控制的输入到安全敏感操作的源到汇调用路径。其次，它生成语义上真实的种子，注入金丝雀标记，并通过反馈引导的调度和变异进行演化。最后，它使用一个预言机来确认攻击者控制的流程并验证可观察的危害，从而验证漏洞。在11个开源代理中（其中8个拥有超过10,000个GitHub星标），TrustProbe识别出104个污点式漏洞。对从ClawHub等公共中心收集的大量真实世界技能语料库进行的验证进一步表明，25.1%的技能-代理试验执行了已识别的漏洞路径，其中载荷注入成功武器化了15个漏洞。这些结果揭示了基于技能的LLM代理中系统性的信任失败：不受信任的技能内容能够到达安全敏感操作，并行使用户委托给其代理的权限。
英文摘要
LLM agents increasingly rely on installable skills, which are packages of instructions, code, and resources that equip them with task-specific capabilities and, once installed, can be automatically invoked across subsequent user tasks. This creates a chain of trust in which users delegate authority to agents, while agent frameworks admit skill-provided content into the agents' context with insufficient validation, allowing malicious skills to influence agent behavior under that delegated authority. Yet, little is known about whether this trust model adequately constrains untrusted skill content before it reaches security-sensitive operations, or how frequently such trust violations arise in real-world agents. We present TrustProbe, a framework for uncovering unsafe chains of trust in skill-based LLM agents. First, TrustProbe analyzes agent source code to identify source-to-sink call paths from skill-controlled inputs to security-sensitive operations. Second, it generates semantically realistic SKILL.md seeds with injected canaries and evolves them through feedback-guided scheduling and mutation. Finally, it validates vulnerabilities using an oracle that confirms attacker-controlled flows and verifies observable harm. Across 11 open-source agents, eight with more than 10,000 GitHub stars, TrustProbe identifies 104 taint-style vulnerabilities. Validation on a large corpus of real-world skills collected from public hubs such as ClawHub further shows that 25.1% of skill-agent trials exercise the identified vulnerable paths, with payload injection successfully weaponizing 15 of the vulnerabilities. These results reveal a systematic trust failure in skill-based LLM agents: untrusted skill content can reach security-sensitive operations and exercise authority delegated by users to their agents.
发表机构
- Institute of Information Engineering, Chinese Academy of Sciences（中国科学院信息工程研究所）
- Worcester Polytechnic Institute（伍斯特理工学院）
- School of Cyberspace Security, University of Chinese Academy of Sciences（中国科学院大学网络空间安全学院）
机构由 AI 辅助整理，请以论文原文为准。
