SkillSecurer detects and fixes AI agent skill vulnerabilities
SkillSecurer: Detecting and Patching Prompt-Injection Vulnerabilities in AI Agent Skills
Cryptography and Security
Summary
AI agents rely on skills—sets of instructions and scripts—to operate, but these skills can be tricked to make the AI do harmful things. The authors built SkillSecurer, a system that acts like two agents: one tries to sneak in bad instructions, and the other looks for these problems and suggests fixes. They tested SkillSecurer thoroughly and it caught every attempted trick in their tests. When checking popular AI skills online, they found many had hidden security issues that could cause real problems. This work helps make AI agents safer by not just finding issues but also pointing exactly where they happen and how to fix them.
What this means in practice
- •For ai developers: Scan AI agent skills for hidden manipulation attempts and receive detailed fixes to improve skill security.
- •For cybersecurity teams: Automatically detect and localize prompt injections in AI skills to prevent attacks on AI decision-making systems.
Authors
Donato Mecca, Alberto Verna, Youness Bouchari, Nikhil Jha, Marco Mellia
Abstract
Agent skills extend AI agents with reusable instructions, scripts, and configuration, but are also open to new attacks to influence an agent's decisions and actions. To address these risks, we present SkillSecurer, a fully agentic framework for generating, detecting, localising, and remediating security risks in agent skills. Its red agent generates context-compatible injections across nine threat types while recording the exact modification; its blue agent analyses complete skill packages, produces grounded evidence, and proposes patches. For controlled instances, a verifier compares findings and patches with the recorded injection, enabling injection-level evaluation. We thoroughly evaluate SkillSecurer by selecting the best backend LLM, comparing it with competitors, and manually cross-validating each evaluation stage. With its best performing backend, SkillSecurer is the only scanner to achieve a 100% injection detection rate. Next, we analyse popular skills from skills.sh, finding latent vulnerabilities in more than 17% of the skills examined. Testing some of those skills, we trigger actual incidents, showing the risks of running unverified skills. Our results show that context-aware LLM analysis can provide reliable injection localisation and actionable remediation beyond skill-level flagging alone.