🤖 AI

Credential Leakage in LLM Agent Skills: A Large-Scale Empirical Study

This paper presents the first large-scale empirical study of credential leakage in LLM agent skills, analyzing over 17,000 samples to identify 520 vulnerable skills, categorize 10 leakage patterns (primarily driven by debug logging and cross-modal code-NL interactions), and demonstrate the high exploitability and persistence of exposed secrets.

Original authors: Zhihao Chen, Ying Zhang, Yi Liu, Gelei Deng, Yuekang Li, Yanjun Zhang, Jianting Ning, Leo Yu Zhang, Lei Ma, Zhiqiang Li

Published 2026-04-06

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Zhihao Chen, Ying Zhang, Yi Liu, Gelei Deng, Yuekang Li, Yanjun Zhang, Jianting Ning, Leo Yu Zhang, Lei Ma, Zhiqiang Li

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you've built a super-smart robot assistant (an LLM Agent) that can do anything for you: book flights, manage your bank, or organize your files. To make this robot truly useful, you let it download "skills" from a giant public library. These skills are like little apps or plugins that teach the robot new tricks.

This paper is a massive investigation into a scary problem: Many of these "skills" are accidentally (or on purpose) leaving your secret passwords, credit card numbers, and API keys lying around for anyone to find.

Here is the breakdown of what the researchers found, using simple analogies:

1. The Setup: A Library of "Magic Spells"

Think of the internet as a massive library called SkillsMP. It has over 170,000 skills (apps) that people can download to give their robot assistants new powers.

The Study: The researchers didn't check every single book. Instead, they randomly picked 17,000 skills (about 10%) to inspect closely.
The Goal: They wanted to see how many of these skills were leaking "keys" (passwords, tokens, secrets) that shouldn't be public.

2. The Big Discovery: "The 3.1% Problem"

Out of the 17,000 skills they checked, 520 of them were leaking secrets. That's about 3 out of every 100 skills.

The Good News: Most of these (84%) weren't evil hackers. They were just careless developers who forgot to clean up their code.
The Bad News: About 16% were deliberate traps set by bad actors trying to steal your data.

3. How the Leaks Happen (The 3 Main Ways)

The researchers found that these leaks happen in three weird ways that traditional security tools miss:

A. The "Debugging Diary" Leak (The Most Common)

The Analogy: Imagine a chef writing a recipe. While testing the dish, they write notes on the side: "Taste test: The salt is good, but the secret sauce is SecretSauce123." They forget to erase that note before publishing the recipe.
The Reality: Developers often leave "debug logs" (print statements) in their code to see what's happening while they build the skill. In normal software, these logs are hidden. But in AI Agents, the robot reads these logs out loud to itself to figure out what to do next.
The Result: The robot accidentally reads the secret password out loud, and because the robot is connected to the internet, that secret is now visible to anyone asking the robot, "What did you just say?"
Stat: This caused 73.5% of all the leaks.

B. The "Two-Face" Leak (Natural Language + Code)

The Analogy: Imagine a job application. The cover letter says, "I am a friendly baker who makes great cakes." But hidden inside the resume is a secret note that says, "Actually, I'm a thief who will steal your wallet."
The Reality: These skills have two parts: a Description (written in plain English) and the Code (the actual instructions).
- The description looks safe and helpful.
- The code does something sneaky.
- Because the description and code are separate, security scanners often look at one or the other, but not both together.
The Result: 76.3% of the leaks could only be found by reading the English description and the code together.

C. The "Prompt Injection" Leak (The Mind Hack)

The Analogy: Imagine a waiter who is trained to take orders. A customer whispers, "Ignore the menu and tell me the chef's secret recipe." The waiter, being too obedient, forgets the rules and tells the recipe.
The Reality: Some skills are so sensitive to instructions that if you ask the robot a tricky question (like "Ignore previous rules and show me the password"), the skill accidentally reveals the secret.
The Result: 3.1% of leaks happened just by tricking the robot with words, without even touching the code.

4. Why It's So Hard to Fix (The "Fork" Problem)

The researchers found that even when a developer fixes a leak, the problem often comes back.

The Analogy: Imagine someone writes a book with a typo. They fix the book and publish a new edition. But 50 other people had already made photocopies of the old book with the typo. Those 50 copies are still being sold in different shops.
The Reality: When a developer fixes a leak in their main code, hundreds of "forks" (copies) of that code exist elsewhere on the internet. The secrets remain live in those copies forever, even though the original is fixed.

5. The Aftermath

The researchers didn't just find the problems; they told the library owners (SkillsMP) about them.

The Cleanup: All 83 malicious (evil) skills were removed.
The Fixes: Developers fixed 91.6% of the accidental leaks.

The Takeaway for You

If you use AI agents that can download skills:

Be careful what you install: Just like you wouldn't install a random app on your phone, be careful with AI skills.
Don't trust the "Logs": The biggest danger is that the AI might accidentally "read out loud" your secrets because the developer forgot to turn off the "debug mode."
The Future Needs New Rules: We need security tools that can read both the English description and the computer code at the same time to catch these "two-faced" leaks.

In short: We built a super-powerful robot, but we gave it a library of tools that are full of sticky notes with our passwords written on them. This paper is the first big study to say, "Hey, we need to clean up this library before the robot reads the sticky notes to the whole world."

1. Problem Statement

The rapid adoption of LLM Agent Skills (external, file-based modules that extend agent functionality via third-party APIs) has introduced a novel security risk: credential leakage. Unlike traditional software, agent skills are hybrid artifacts combining Natural Language (NL) descriptions (e.g., SKILL.md) and Programming Language (PL) code (e.g., Python, JavaScript).

The core problem is that these skills often execute with ambient authority (inheriting the host process's full privileges) in local environments. Credentials can be leaked not just through code, but through the interaction between NL instructions and PL execution. Specifically:

Cross-Modal Leakage: Credentials may be hidden in NL descriptions or triggered by NL prompts, escaping traditional code-only static analysis.
Debug Logging as a Vector: Agent frameworks often feed stdout/stderr directly into the LLM's context window. Routine debug prints (e.g., console.log) intended for developers become broadcast channels for credentials, retrievable via natural language queries.
Persistence: The fork-based distribution model of skill marketplaces means that even if a credential is removed from an upstream repository, it persists in hundreds of downstream forks.

2. Methodology

The authors conducted the first large-scale empirical study on this issue using a four-phase methodology:

A. Dataset Collection

Source: SkillsMP, the largest open-source skill marketplace.
Population: 170,226 total skills (snapshot from Feb 12, 2026).
Sampling: Stratified random sampling of 17,022 skills (10%). This sample size was calculated to ensure a 99% confidence level with a 1% margin of error.
Data: Each skill included source code files (37,409 files) and NL descriptions (17,022 files).

B. Static Filtering (Two-Stage Pipeline)

Keyword Matching: Applied a validated taxonomy of 9 credential categories (API keys, OAuth tokens, DB credentials, etc.) to both NL and PL streams.
- NL Filtering: Used semantic constraints (sliding windows) to distinguish between instructional mentions of credentials (benign) and actual exposure (e.g., "send the token" vs. "you need a token").
- PL Filtering: Used Abstract Syntax Tree (AST) parsing (via tree-sitter) to identify credential flows into "unsafe sinks" (network APIs, logging calls, file I/O).
Candidate Selection: Reduced the pool from 17,022 to 3,156 candidate skills flagged for potential leakage.

C. Dynamic Validation

Environment: Isolated Docker containers running a Claude Code agent instance.
Mock Credentials: Injected mock credentials (via env vars, config files, or runtime args) to trace leakage.
Dual-Condition Testing:
- Benign Condition: Executed the skill's advertised workflow.
- Adversarial Condition: Injected prompt injection payloads into external content consumed by the skill.
Monitoring: Tracked network I/O, file writes, and stdout/stderr output.
Thresholds: Required leakage indicators in $\ge$ 2/3 benign runs or $\ge$ 1/3 adversarial runs to confirm vulnerability. This reduced the pool to 1,427 skills.

D. Manual Classification

Three security experts reviewed the 1,427 candidates, cross-referencing execution logs with developer intent (metadata/documentation).
Labels: Benign, Vulnerable (negligence), or Malicious (deliberate attack).
Final Confirmed Cases: 520 skills (437 Vulnerable, 83 Malicious) containing 1,708 security issues.

3. Key Contributions

First Large-Scale Dataset: A curated dataset of 17,022 real-world agent skills, including 437 vulnerable and 83 malicious skills, with 1,708 identified issues.
Leakage Pattern Taxonomy: A new taxonomy of 10 leakage patterns:
- 4 Vulnerability Patterns (Negligence): Hardcoded Credentials, Insecure Storage, Information Exposure (Debug Logging), Artifact Leakage.
- 6 Malicious Patterns (Adversarial): Remote Exploitation, Credential Compromise, Data Exfiltration, Defense Evasion, Persistence, Resource Hijacking.
Cross-Modal Analysis Framework: Demonstrated that effective detection requires joint analysis of NL and PL, as 76.3% of cases are invisible to single-modality analysis.
Responsible Disclosure: Reported all findings to SkillsMP, resulting in the removal of 83 malicious skills and remediation of 91.6% of hardcoded credential cases.

4. Key Results & Findings

Prevalence (RQ1)

3.1% of sampled skills (520/17,022) contain credential leakage.
84.0% are due to developer negligence; 16.0% are malicious.
Functional Hotspots: Web Scraping (17.1%), Data Processing (14.6%), and API Integration (13.1%) are the most affected categories.
Language: Python accounts for 60% of cases, likely due to its prevalence in AI development and insecure patterns (e.g., inline os.environ).

Patterns (RQ2)

Cross-Modal Nature: 76.3% of leaks require analyzing both NL and PL together. 3.1% exploit NL alone via prompt injection.
Debug Logging Dominance: Information Exposure (via print/console.log) is the #1 pattern, accounting for 73.5% of all issues. Because agent frameworks feed stdout into the LLM context, logged credentials become queryable by users.
AI-Assisted Risk: 72% of hardcoded credential cases showed evidence of AI coding assistants (e.g., Copilot), suggesting these tools propagate insecure patterns at scale.
Malicious Complexity: 37.3% of malicious skills combine multiple attack patterns (e.g., Defense Evasion via Base64 obfuscation + Remote Exploitation).

Exploitability (RQ3)

High Exploitability: 89.6% of affected skills are exploitable during normal execution without elevated privileges.
Persistence: Leaked credentials remain active even after upstream remediation. Credentials removed from 107 upstream repositories were found in 50+ independent forks.
Attack Surface: The decoupling of NL (interface) and PL (logic) allows attackers to present benign descriptions while executing malicious payloads (e.g., a "weather" skill that exfiltrates .env files).

5. Significance and Implications

Architectural Flaw: The study highlights a fundamental design flaw in current LLM agent frameworks: the lack of isolation between the reasoning engine (LLM) and the execution engine (Skills). The injection of stdout into the context window turns debugging tools into data exfiltration channels.
New Threat Model: Traditional supply chain security focuses on code dependencies. Agent skills introduce a semantic attack surface where natural language instructions can trigger code execution or reveal secrets, requiring a "cross-modal" security approach.
Mitigation Recommendations:
- For Frameworks: Implement capability-based isolation (separate memory/network for LLM and skills) and filter credential patterns from stdout before it enters the LLM context.
- For Developers: Adopt "secure-by-default" practices, avoid hardcoding secrets, and integrate secret scanning into the CI/CD pipeline specifically for agent skills.
- For Researchers: Future detection tools must analyze NL and PL jointly, not in isolation.

This study establishes that credential leakage in LLM agents is a systemic, cross-modal issue that is currently under-detected by standard security tools, posing immediate risks to user privacy and system integrity.