LATIDIA · Ciberseguridad

Escanee antes de instalar: Detección y mitigación de vulnerabilidades locales y compuestas en Skills.

arXiv:2610.37901v1 Anuncio Tipo: nuevo Resumen: Una habilidad de agente empaqueta instrucciones en lenguaje natural, scripts y archivos de referencia que un agente basado en LLM carga para una tarea. Las habilidades pueden acceder al sistema de archivos, shell y

La noticia

arXiv:2610.37901v1 Announce Type: new Abstract: An agent skill packages natural-language instructions, scripts, and reference files that an LLM-based agent loads for a task. Skills may access the file system, shell, and network under user-authorized permissions; weaknesses can lead to unsafe execution. Existing scanners primarily target malicious skills, not unintended vulnerabilities in public repositories, and analyze skills in isolation, overlooking multi-skill interactions. To address these gaps, we developed a six-module scanner: Content Extraction, Local Analysis, Composite Analysis, Validation, Reporting, and Mitigation. Local Analysis detects unintended vulnerabilities in benign skills. On a 556-case leaderboard subset of SkillTrustBench, it achieved 95.90% recall with a 4.22% false positive rate; on a balanced sample of