{"slug": "malicious-agent-skills-in-the-wild", "title": "Malicious Agent Skills in the Wild", "summary": "A systematic security analysis of 98,380 LLM coding-agent skills from two major registries identified 157 malicious skills containing 632 distinct vulnerabilities across 13 attack techniques, with over half originating from a single threat actor using templated brand impersonation. Researchers found each malicious skill averaged 4.03 vulnerabilities and that attack sophistication correlated with concealment investment; all reported skills were removed by registry maintainers following responsible disclosure.", "body_md": "# Computer Science > Cryptography and Security\n\n[Submitted on 6 Feb 2026 (\n\n[v1](https://arxiv.org/abs/2602.06547v1)), last revised 10 Jun 2026 (this version, v4)]# Title:\"Do Not Mention This to the User\": Detecting and Understanding Malicious Agent Skills in the Wild\n\n[View PDF](/pdf/2602.06547)\n\n[HTML (experimental)](https://arxiv.org/html/2602.06547v4)\n\nAbstract:LLM-based coding agents increasingly rely on third-party extensions called skills, which bundle natural language instructions and helper scripts that execute with full user privileges. Community registries have emerged to distribute these skills, but the security implications remain unstudied due to the absence of labeled threat data. This paper presents a systematic security analysis of 98,380 skills collected from two major registries. Through a combination of static pattern matching and dynamic behavioral verification, we identify 157 skills exhibiting confirmed malicious behavior, encompassing 632 distinct vulnerabilities across 13 attack techniques. Our analysis reveals that these threats are deliberate rather than accidental: each malicious skill contains an average of 4.03 vulnerabilities spanning multiple attack phases. We identify two dominant attack strategies with statistically significant negative correlation -- credential theft via remote code execution, and agent manipulation through adversarial instructions embedded in documentation. Over half of all confirmed cases originate from a single threat actor employing templated brand impersonation at scale. We further observe that attack sophistication correlates with concealment investment, with advanced skills universally employing undocumented capabilities while also exploiting platform-native trust mechanisms. Following responsible disclosure, registry maintainers removed all 157 (100%) of the reported skills. Our dataset and detection pipeline are publicly available to facilitate future research on securing LLM agent ecosystems.\n\n## Submission history\n\nFrom: Yi Liu [[view email](/show-email/903f3a8c/2602.06547)]\n\n**Fri, 6 Feb 2026 09:52:27 UTC (176 KB)**\n\n[[v1]](/abs/2602.06547v1)**Sat, 14 Mar 2026 01:34:44 UTC (176 KB)**\n\n[[v2]](/abs/2602.06547v2)**Mon, 1 Jun 2026 13:03:27 UTC (176 KB)**\n\n[[v3]](/abs/2602.06547v3)**[v4]** Wed, 10 Jun 2026 03:31:37 UTC (178 KB)\n\n### Current browse context:\n\ncs.CR\n\n### References & Citations\n\nLoading...\n\n# Bibliographic and Citation Tools\n\nBibliographic Explorer\n\n*(*[What is the Explorer?](https://info.arxiv.org/labs/showcase.html#arxiv-bibliographic-explorer))\nConnected Papers\n\n*(*[What is Connected Papers?](https://www.connectedpapers.com/about))\nLitmaps\n\n*(*[What is Litmaps?](https://www.litmaps.co/))\nscite Smart Citations\n\n*(*[What are Smart Citations?](https://www.scite.ai/))# Code, Data and Media Associated with this Article\n\nalphaXiv\n\n*(*[What is alphaXiv?](https://alphaxiv.org/))\nCatalyzeX Code Finder for Papers\n\n*(*[What is CatalyzeX?](https://www.catalyzex.com))\nDagsHub\n\n*(*[What is DagsHub?](https://dagshub.com/))\nGotit.pub\n\n*(*[What is GotitPub?](http://gotit.pub/faq))\nHugging Face\n\n*(*[What is Huggingface?](https://huggingface.co/huggingface))\nScienceCast\n\n*(*[What is ScienceCast?](https://sciencecast.org/welcome))# Demos\n\n# Recommenders and Search Tools\n\nInfluence Flower\n\n*(*[What are Influence Flowers?](https://influencemap.cmlab.dev/))\nCORE Recommender\n\n*(*[What is CORE?](https://core.ac.uk/services/recommender))# arXivLabs: experimental projects with community collaborators\n\narXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.\n\nBoth individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.\n\nHave an idea for a project that will add value for arXiv's community? [ Learn more about arXivLabs](https://info.arxiv.org/labs/index.html).", "url": "https://wpnews.pro/news/malicious-agent-skills-in-the-wild", "canonical_source": "https://arxiv.org/abs/2602.06547", "published_at": "2026-07-21 02:55:20+00:00", "updated_at": "2026-07-21 03:23:18.803053+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "artificial-intelligence"], "entities": [], "alternates": {"html": "https://wpnews.pro/news/malicious-agent-skills-in-the-wild", "markdown": "https://wpnews.pro/news/malicious-agent-skills-in-the-wild.md", "text": "https://wpnews.pro/news/malicious-agent-skills-in-the-wild.txt", "jsonld": "https://wpnews.pro/news/malicious-agent-skills-in-the-wild.jsonld"}}