Right Family, Wrong Skill: Benchmarking Risk Exposure in Agent Skill Retrieval

In the emerging world of artificial intelligence, software agents are learning to act on our behalf. These digital assistants do not just answer questions; they perform tasks by reaching into a vast library of specialized tools, or "skills," to get the job done. Imagine a librarian who can not only find a book but also open it, read the instructions inside, and then use a hammer or a calculator mentioned in the text to fix a broken chair. For this to work, the agent must retrieve the right tool for the specific moment. If the task requires a delicate operation, the agent needs a skill that is precise and safe. If the task is rough and ready, it needs a different approach. The challenge is that these libraries are growing huge and messy, filled with tools that look very similar on the surface but behave differently under the hood.

The problem is not just finding a tool that seems relevant; it is avoiding the trap of picking the wrong version of the right tool. A researcher might need a skill that handles data safely, but the library contains a nearly identical skill that ignores safety checks. If the agent grabs the wrong one, the consequences can range from a failed task to a dangerous error. This specific failure—finding the correct family of tools but selecting the wrong representative from that family—has been difficult to measure until now. A team of researchers at Huawei Technologies and Tongji University has set out to map this danger, creating a new way to test how well agents can distinguish between helpful tools and their risky lookalikes.

The researchers built a testing ground called SameCapRisk-Bench, a controlled environment designed to catch this specific type of mistake. They created over 1,100 test cases where an agent is asked to solve a problem. For each problem, there is a perfect skill that fits the job and a "risky sibling"—a tool that belongs to the same category but has a hidden flaw, such as missing a safety check or using the wrong resource. The goal was to see if the agent's retrieval system could pick the perfect skill while ignoring the dangerous twin. The test included two types of challenges. The first involved a large, public library of thousands of skills to see if the agent could find the right one among many distractions. The second was a harder test where the roles of the two skills were swapped: the tool that was helpful in one scenario became the risky one in a slightly different scenario, forcing the system to pay attention to the specific details of the request rather than just the general topic.

When the researchers ran their tests, they found that current systems are quite good at finding the right general category of tools but often fail to pick the safe version. Using standard public retrieval systems, the agents successfully found the helpful skill in nearly 90 percent of the cases. However, in about 35 to 37 percent of those successful cases, the system also pulled in the risky sibling into the top results. This means that even when the agent finds the right family of tools, it frequently exposes itself to the wrong representative. The researchers measured this using a metric they call the harmful sibling rate, which tracks how often the dangerous lookalike appears in the final list of choices. The data showed that while the systems were excellent at recall—finding the right tool—they were not good at filtering out the unsafe one.

To solve this, the team tested a new approach that separates the process into two steps. First, the system identifies which tools belong to the same family. Second, it makes a specific choice to pick only one representative from that family before ranking the final results. When they applied this method, the results changed dramatically. The system still found the helpful skill at a high rate, but the number of times it accidentally included the risky sibling dropped from over 30 percent down to less than 1 percent in the best cases. This proved that the failure was not in finding the right topic, but in the final decision of which specific tool to use. The study suggests that simply making a list of relevant tools is not enough; the system must actively decide which version of a tool is safe for the current task.

The findings highlight a critical gap in how AI agents are currently built. Most systems focus on matching the user's question to the right topic, assuming that if the topic is right, the tool is safe. This paper demonstrates that assumption is flawed. Two tools can share the same name and description but have different rules for how they operate. One might require a specific permission to run, while the other does not. If the agent picks the one without the permission check, it might crash or behave unpredictably. The researchers showed that by adding a step to resolve these family conflicts—essentially asking, "Which of these similar tools is actually the right one for this specific request?"—the risk of exposure drops significantly without sacrificing the ability to find the correct tool.

This work does not claim to have solved all safety issues in AI, nor does it suggest that every tool in a library is dangerous. Instead, it provides a clear measurement for a specific, overlooked risk. The researchers found that even the most advanced public systems struggle with this distinction, often exposing the wrong tool in more than a third of the cases where they find the right family. However, they also showed that this is a solvable problem. By treating the choice of a specific tool as a distinct decision from the choice of a general topic, developers can build systems that are both capable and careful. The study concludes that future benchmarks for AI agents should not just measure if the right tool was found, but also if the wrong, risky version was kept out of the final selection. This shift in focus could lead to more reliable agents that understand not just what they need to do, but exactly how they need to do it safely.