[Submitted on 6 Feb 2026 (
[v1](https://arxiv.org/abs/2602.06547v1)), last revised 10 Jun 2026 (this version, v4)]# Title:"Do Not Mention This to the User": Detecting and Understanding Malicious Agent Skills in the Wild
[View PDF](/pdf/2602.06547)
[HTML (experimental)](https://arxiv.org/html/2602.06547v4)
Abstract:LLM-based coding agents increasingly rely on third-party extensions called skills, which bundle natural language instructions and helper scripts that execute with full user privileges. Community registries have emerged to distribute these skills, but the security implications remain unstudied due to the absence of labeled threat data. This paper presents a systematic security analysis of 98,380 skills collected from two major registries. Through a combination of static pattern matching and dynamic behavioral verification, we identify 157 skills exhibiting confirmed malicious behavior, encompassing 632 distinct vulnerabilities across 13 attack techniques. Our analysis reveals that these threats are deliberate rather than accidental: each malicious skill contains an average of 4.03 vulnerabilities spanning multiple attack phases. We identify two dominant attack strategies with statistically significant negative correlation -- credential theft via remote code execution, and agent manipulation through adversarial instructions embedded in documentation. Over half of all confirmed cases originate from a single threat actor employing templated brand impersonation at scale. We further observe that attack sophistication correlates with concealment investment, with advanced skills universally employing undocumented capabilities while also exploiting platform-native trust mechanisms. Following responsible disclosure, registry maintainers removed all 157 (100%) of the reported skills. Our dataset and detection pipeline are publicly available to facilitate future research on securing LLM agent ecosystems.
Submission history #
From: Yi Liu [[view email](/show-email/903f3a8c/2602.06547)]
**Fri, 6 Feb 2026 09:52:27 UTC (176 KB)**
[[v1]](/abs/2602.06547v1)**Sat, 14 Mar 2026 01:34:44 UTC (176 KB)**
[[v2]](/abs/2602.06547v2)**Mon, 1 Jun 2026 13:03:27 UTC (176 KB)**
[[v3]](/abs/2602.06547v3)**[v4]** Wed, 10 Jun 2026 03:31:37 UTC (178 KB)
Current browse context:
cs.CR
References & Citations
...
Bibliographic Explorer
(What is the Explorer?) Connected Papers
(What is Connected Papers?) Litmaps
(What is Litmaps?) scite Smart Citations
(What are Smart Citations?)# Code, Data and Media Associated with this Article alphaXiv
(What is alphaXiv?) CatalyzeX Code Finder for Papers
(What is CatalyzeX?) DagsHub
(What is DagsHub?) Gotit.pub
(What is GotitPub?) Hugging Face
(What is Huggingface?) ScienceCast
(What is ScienceCast?)# Demos Influence Flower
(What are Influence Flowers?) CORE Recommender
(What is CORE?)# arXivLabs: experimental projects with community collaborators arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.
Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.
Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.