Malicious Agent Skills in the Wild

A systematic security analysis of 98,380 LLM coding-agent skills from two major registries identified 157 malicious skills containing 632 distinct vulnerabilities across 13 attack techniques, with over half originating from a single threat actor using templated brand impersonation. Researchers found each malicious skill averaged 4.03 vulnerabilities and that attack sophistication correlated with concealment investment; all reported skills were removed by registry maintainers following responsible disclosure.

Computer Science Cryptography and Security Submitted on 6 Feb 2026 v1 https://arxiv.org/abs/2602.06547v1 , last revised 10 Jun 2026 this version, v4 Title:"Do Not Mention This to the User": Detecting and Understanding Malicious Agent Skills in the Wild View PDF /pdf/2602.06547 HTML experimental https://arxiv.org/html/2602.06547v4 Abstract:LLM-based coding agents increasingly rely on third-party extensions called skills, which bundle natural language instructions and helper scripts that execute with full user privileges. Community registries have emerged to distribute these skills, but the security implications remain unstudied due to the absence of labeled threat data. This paper presents a systematic security analysis of 98,380 skills collected from two major registries. Through a combination of static pattern matching and dynamic behavioral verification, we identify 157 skills exhibiting confirmed malicious behavior, encompassing 632 distinct vulnerabilities across 13 attack techniques. Our analysis reveals that these threats are deliberate rather than accidental: each malicious skill contains an average of 4.03 vulnerabilities spanning multiple attack phases. We identify two dominant attack strategies with statistically significant negative correlation -- credential theft via remote code execution, and agent manipulation through adversarial instructions embedded in documentation. Over half of all confirmed cases originate from a single threat actor employing templated brand impersonation at scale. We further observe that attack sophistication correlates with concealment investment, with advanced skills universally employing undocumented capabilities while also exploiting platform-native trust mechanisms. Following responsible disclosure, registry maintainers removed all 157 100% of the reported skills. Our dataset and detection pipeline are publicly available to facilitate future research on securing LLM agent ecosystems. Submission history From: Yi Liu view email /show-email/903f3a8c/2602.06547 Fri, 6 Feb 2026 09:52:27 UTC 176 KB v1 /abs/2602.06547v1 Sat, 14 Mar 2026 01:34:44 UTC 176 KB v2 /abs/2602.06547v2 Mon, 1 Jun 2026 13:03:27 UTC 176 KB v3 /abs/2602.06547v3 v4 Wed, 10 Jun 2026 03:31:37 UTC 178 KB Current browse context: cs.CR References & Citations Loading... Bibliographic and Citation Tools Bibliographic Explorer What is the Explorer? https://info.arxiv.org/labs/showcase.html arxiv-bibliographic-explorer Connected Papers What is Connected Papers? https://www.connectedpapers.com/about Litmaps What is Litmaps? https://www.litmaps.co/ scite Smart Citations What are Smart Citations? https://www.scite.ai/ Code, Data and Media Associated with this Article alphaXiv What is alphaXiv? https://alphaxiv.org/ CatalyzeX Code Finder for Papers What is CatalyzeX? https://www.catalyzex.com DagsHub What is DagsHub? https://dagshub.com/ Gotit.pub What is GotitPub? http://gotit.pub/faq Hugging Face What is Huggingface? https://huggingface.co/huggingface ScienceCast What is ScienceCast? https://sciencecast.org/welcome Demos Recommenders and Search Tools Influence Flower What are Influence Flowers? https://influencemap.cmlab.dev/ CORE Recommender What is CORE? https://core.ac.uk/services/recommender arXivLabs: experimental projects with community collaborators arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website. Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them. Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs https://info.arxiv.org/labs/index.html .