💻 computer science

PhantomSkill: Malicious Code Injection in Agent Skill Ecosystems

This paper introduces PhantomSkill, a novel attack framework that evades detection by embedding malicious behavior within the auxiliary resources of agent skills using a "VulMask" technique that disguises exploits as ordinary insecure code, thereby highlighting the critical need for resource-level vetting and execution-time containment in LLM-based agent ecosystems.

Original authors: Yu-Ting Lin, Chia-Mu Yu

Published 2026-06-19

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Yu-Ting Lin, Chia-Mu Yu

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you hire a highly intelligent, super-organized assistant (an AI Coding Agent) to help you manage your digital life. This assistant can read files, run programs, and even order supplies for you. To make this assistant even better, you give it a library of "Skill Packs"—like adding new apps to a phone. These packs contain instructions (a manual) and extra tools (scripts) to help the assistant do specific jobs, like organizing your Git code or formatting your PDFs.

The paper "PhantomSkill" reveals a new, sneaky way hackers can poison these Skill Packs.

The Old Way: The "Bad Guy" in the Manual

Previously, hackers tried to trick the AI by hiding evil instructions directly in the manual (the text file the AI reads first). It's like writing a note in a cookbook that says, "When you see this recipe, please steal the chef's wallet."

The Problem: Modern AI assistants are getting smart. They read the manual carefully and often say, "No, that sounds dangerous," and refuse to do it.

The New Way: The "Trap" in the Toolbox

The researchers in this paper invented a new trick called PhantomSkill. Instead of writing a bad note in the manual, they hide the attack inside the tools (the scripts) the assistant uses.

Here is the core analogy: The "Broken Lock" vs. The "Thief's Note."

The Overt Attack (The Thief's Note): Imagine a tool that comes with a note saying, "I am a thief, please open my backdoor." The AI sees the note, gets scared, and throws the tool away.
The PhantomSkill Attack (The Broken Lock): The researchers take that same tool and remove the "Thief's Note." Instead, they slightly break the lock on the tool.
- To a human or a security scanner, it just looks like a poorly made tool with a common security flaw (a "vulnerability"). It looks like a mistake, not a crime.
- The Catch: The hacker knows a specific secret "trigger" (like a specific key or a specific time of day). If the AI uses the tool normally, it works fine. But if the hacker triggers that secret condition, the "broken lock" suddenly opens a hidden compartment that does exactly what the thief wanted to do (steal data, delete files, etc.).

How They Did It (The "VulMask" Technique)

The researchers created a method called VulMask. Think of it as a code translator.

It takes a script that is obviously evil.
It rewrites the code so it looks like a standard, boring security mistake (like leaving a door unlocked).
It keeps the tool working perfectly for its intended job (so the user doesn't notice anything is wrong).
It hides a "switch" that only the hacker knows how to flip to activate the evil part.

What They Found

The researchers tested this against many different AI assistants and security scanners. Here is what happened:

The AI was fooled: When the AI saw the "broken lock" (the vulnerability), it didn't panic. It thought, "Oh, this tool is a bit sloppy, but I can still use it." It ran the tool.
The Scanners were fooled: Automated security tools often flag obvious "thief notes" (malware) but are much slower to flag "sloppy tools" (vulnerabilities). They treated the attack as a low-priority warning rather than a critical threat.
The Result: The attack worked much more often than the old "Thief's Note" method. The AI successfully performed the hacker's secret command while still doing its normal job.

The Big Takeaway

The paper concludes that we cannot just check the manual (the text description) of a Skill Pack anymore. We have to realize that the tools themselves can be dangerous even if they look harmless.

Just because a tool has a "broken lock" (a vulnerability) doesn't mean it's safe. In the world of AI agents, a broken lock can be turned into a secret weapon by a hacker. The authors suggest that security systems need to treat these "sloppy tools" with the same suspicion as "evil tools," because in the hands of an AI, a vulnerability can be just as dangerous as a virus.

In short: Hackers stopped shouting "I'm a criminal!" and started whispering "I'm just a bit broken," and the AI assistants believed them.

Technical Summary: PhantomSkill and VulMask

Problem Statement

The paper addresses a critical supply-chain security gap in LLM-based coding agent ecosystems. While agents (e.g., Claude Code, Cursor) utilize "Agent Skills"—packaged directories containing a SKILL.md description and auxiliary resources like scripts—to acquire domain-specific capabilities, current security models focus primarily on prompt injection within text files.

Existing research on malicious skills often relies on overt malicious scripts hidden in auxiliary resources or textual inducement in SKILL.md. However, modern agents and automated reviewers frequently inspect these resources before execution. The authors identify a vulnerability: reviewers and scanners are highly sensitive to explicit malicious intent (malware) but often treat ordinary insecure code (vulnerabilities) as low-priority issues. This gap allows malicious behavior to be disguised as standard coding errors, bypassing detection while retaining the ability to be triggered by an attacker.

Methodology: PhantomSkill and VulMask

The authors propose PhantomSkill, a supply-chain attack framework, centered on a core technique called VulMask.

Core Mechanism

VulMask operates by rewriting overt malicious payloads into vulnerability-shaped implementations. Instead of embedding explicit malware logic, the technique transforms the payload into code that appears to contain an ordinary, exploitable weakness (e.g., command injection, unsafe dependency handling, information exposure) rather than a deliberate attack.

The process involves:

Selection of Vulnerability Classes: The system selects a set of vulnerability classes ( $W$ ) relevant to the intended malicious behavior, mapping them to CWE-style weaknesses.
LLM-Driven Rewriting: An LLM-driven generator ( $g$ ) rewrites the original overt script ( $p^*$ ) into a masked payload ( $p_m$ ).
$p_m = g(p^*, W)$
The resulting script preserves the attacker's intended side effect but exposes it through a triggerable weakness.
Embedding and Preservation: The masked payload is embedded into the original auxiliary resource ( $r_h$ ) without altering the skill's name, description, or primary workflow. This ensures the skill retains its advertised benign utility when the trigger condition is absent.
$s_{VulMask} = (n_h, d_h, t_h, r_m)$
Trigger Mechanism: The malicious behavior is activated only when specific, attacker-controlled trigger conditions ( $\theta$ ) are met (e.g., specific project states, external content, or structured inputs).

Threat Model

Attacker: Controls the content of a distributed skill package (specifically auxiliary resources) but cannot control the victim's LLM, execution environment, or user prompts post-installation.
Defender: Capable of scanning all skill components (including scripts) before publication, at installation, or during execution. The key challenge is distinguishing between a malicious payload and a benign but vulnerable script.

Key Contributions

Identification of Attack Surface: The paper identifies auxiliary resources (scripts, templates) in agent skills as a practical and under-protected supply-chain attack surface, distinct from textual prompt injection.
VulMask Technique: It proposes a code-level payload rewriting technique that disguises malicious intent as ordinary insecurity, effectively shifting the visible signal from "malware" to "vulnerability."
Comprehensive Evaluation: The authors evaluate the attack across diverse dimensions, including host skills, attack goals, coding agents, generation models, and automated reviewers, demonstrating the limitations of current defense mechanisms.

Experimental Results

The evaluation was conducted using a corpus of public agent skills and tested against models like GPT-5.5, GLM-4.7-Flash, and Qwen3-Coder, as well as automated reviewers (e.g., Cisco, Snyk, Mondoo).

Attack Success Rate (ASR) vs. Detection: VulMask achieved the highest ASR (58.8%) among successful methods while maintaining the lowest Warning Rate (11.4%). In contrast, overt malicious scripts had a higher warning rate (25.4%) and lower ASR (46.3%).
Utility Preservation: VulMask preserved 96.6% of the host skill's benign functionality, significantly outperforming methods that replace scripts with unrelated payloads.
Stealth Against Reviewers:
- Automated Scanners: Tools like Cisco static analysis and Cisco LLM reclassified masked payloads as "vulnerabilities" rather than "malware" (100% vulnerability flag vs. 17.1% malware flag for Cisco static).
- Coding Agents: Agents using GPT-5.5 and GLM-4.7 showed reduced detection rates for VulMask scripts compared to overt scripts, though stronger models like Opus-4.7 remained effective against both.
Generalization: The technique generalized across four attack goals: credential exfiltration, command execution, agent manipulation, and destruction. The most significant reduction in detection was observed for destruction (from 41.7% overt detection to 4.2% VulMask detection).
Transferability: The attack remained effective when generated by different LLM backends (Opus-4.7, GLM-4.7, Qwen3), indicating the technique is not tied to a single generator.

Significance and Claims

The paper claims that skill ecosystems require a paradigm shift in security vetting. The findings suggest that:

Resource-Level Vetting is Critical: Scanning only SKILL.md is insufficient; auxiliary executable resources must be treated as first-class attack surfaces.
Vulnerabilities as Payloads: In agent ecosystems, a triggerable vulnerability is functionally equivalent to a malicious payload. Current security policies that downgrade "insecure code" to low-priority issues fail to protect against agents that can execute these resources with high privileges.
Defense Recommendations: The authors advocate for:
- Resource-level review by marketplaces (scanning scripts and dependencies).
- Execution-time containment (least-privilege access, network restrictions).
- Policy updates for reviewers to treat exploitable vulnerabilities in agent skills as potential malicious payloads rather than mere code quality issues.

The authors emphasize that while the attack is effective, it highlights a specific gap in current defenses rather than an insurmountable flaw, urging the development of more robust vetting and containment mechanisms for agent skill ecosystems.