Skills for AI agents can hide attacks from detection tools
Pretext: Defeating Malicious Skill Detection Frameworks for AI Agents
Cryptography and SecurityArtificial Intelligence
Summary
AI agents often use extra programs called skills to do more things. Some of these skills can be bad and let attackers control the AI secretly. The authors show that current tools designed to catch these bad skills can be tricked by cleverly hiding the harmful parts inside normal-looking instructions. Their method, called Pretext, fools these detectors in most cases, which means current protection methods have big weaknesses.
What this means in practice
- •For ai security teams: Identify limitations in current skill scanning tools to improve detection of hidden malicious behaviors in AI agent extensions.
- •For software developers: Design safer skills by understanding how attackers evade detection and adjusting validation processes accordingly.
Authors
Tobias Kaisar, Aritra Dhar
Abstract
Skills extend an agent's capabilities by injecting instructions and information into the context, and are widely used by agents such as OpenClaw and Claude Code. Prior work shows third-party marketplaces host malicious skills that give attackers direct influence over the victim's agent. The emerging defense scans skills before installation, pairing deterministic static checks with an LLM-based semantic judge, as in NVIDIA's SkillSpector. We show that such defenses fall to an attacker who knows the detector. Our white-box LLM attacker, Pretext, iteratively crafts skills that evade detection while still delivering the payload and performing the benign task: moving the payload from code into natural language leaves static analysis inert, while framing it as the skill's legitimate purpose and splitting instructions across files keeps the LLM stage below its blocking threshold. Across three open-source models, Pretext achieves up to 97\% and 77\% against a frozen detector and a co-adaptive one, respectively, revealing major gaps in current skill scanners.