Technical Summary: Skills That Don't Exist: A Large-Scale Study of Hallucinated Skill Recommendation in LLM Agents

Problem Definition: Skill Name Hallucination

The paper identifies a critical vulnerability in the emerging ecosystem of LLM agents, specifically within the "Agent Skills" framework (standardized by Anthropic in late 2025). Developers increasingly rely on agents to recommend and install skills—bundles of natural-language instructions (stored in SKILL.md files)—rather than manually browsing registries.

The core problem is skill name hallucination: the agent confidently recommends a skill name that does not exist in any registry. Unlike standard code generation hallucinations where a model invents a non-existent function, this flaw creates a specific supply-chain attack vector. Because registries often lack strict publisher verification, an adversary can:

1. Query public agents to identify recurring hallucinated names.
2. Pre-register a malicious skill under that exact name on an open registry.
3. Wait for a victim to ask the agent for a recommendation.
4. The agent, having hallucinated the same name previously, recommends the malicious skill, which the user then installs.

This attack bypasses traditional defenses because the name is not a typo of a real package (making it invisible to typosquatting filters) and the payload is hidden in natural language instructions rather than executable code.

Methodology

The authors conducted the first large-scale measurement of this phenomenon using a three-stage pipeline across 15,000 prompts and 12 system configurations (4 standalone LLMs and 8 agent configurations).

1. Prompt Construction

The dataset consisted of two distinct prompt types to isolate different causes of hallucination:

• Community Prompts (5,000): Real-world questions scraped from Stack Exchange, Reddit, and Hacker News regarding skill recommendations. These measure hallucination rates in unstructured, real-world scenarios where a correct skill might not exist.
• Skill Description Prompts (10,000): Generated from the descriptions of 10,000 real, published skills on the SkillsMP registry. Since a correct answer is known to exist for every prompt, hallucinations here indicate a failure to retrieve existing knowledge rather than a lack of options.

2. Evaluation Configurations

The study evaluated:

• Standalone LLMs: GLM-4.5-Air, GPT-5.4-mini, Claude Sonnet 4.6, and Claude Opus 4.7.
• Agents: Claude Code, Codex, OpenClaw, and OpenCode (using various backends including GPT-5.4-mini and four open-source models).
• Grounding: Most configurations were equipped with web-search tools to test if external verification mitigates the issue.

3. Validation Pipeline

To ensure absolute accuracy, a recommended name was classified as hallucinated only if it was missing from all live registries (SkillsMP, ClawHub, etc.) and did not exist in any open-source repository (verified via GitHub Code Search for SKILL.md files).

Key Contributions

1. Identification of a New Attack Vector: The paper formalizes "skill name squatting," where attackers exploit the deterministic nature of LLM hallucinations to pre-register malicious skills.
2. Large-Scale Measurement: A systematic evaluation of 15,000 prompts revealing that hallucination is ubiquitous across all tested models and agents.
3. Targetability Analysis: Demonstration that hallucinated names are not random noise but follow predictable patterns, allowing attackers to achieve high coverage with minimal effort.
4. Defense Evaluation: A rigorous assessment of four mitigation strategies (RAG, self-refinement, cross-model voting, and their combinations), highlighting severe trade-offs between security and utility.

Key Results

1. Prevalence (RQ1)

• Ubiquity: Every single configuration hallucinated.
• Rates: Hallucination rates averaged 36.0% for standalone LLMs and 36.9% for agents.
• Real-World Impact: On real developer questions (Community Prompts), the rate rose to 43.1%.
• Ineffectiveness of Search: Enabling web search did not solve the problem. Models often search for the concept (e.g., "file-system-operations") and find relevant results, confirming the concept exists but failing to verify the specific skill name's registration status.
• Conservative Output: Some models (e.g., GPT-5.4-mini) achieved low hallucination rates (6.5%) primarily by returning no output for 52.5% of prompts, rather than by accurately identifying real skills.

2. Targetability (RQ2)

• Determinism: Hallucinated names are highly persistent. For example, Claude Sonnet 4.6 repeated its dominant hallucinated name 7.8 times out of 10 for the same prompt.
• Convergence: Different models often converge on the same hallucinated names (e.g., six models generated classification-model-builder).
• Cross-Ecosystem Overlap: 15.0% of unique hallucinated skill names (851 names) exactly matched existing PyPI or npm packages, indicating models reuse familiar package identifiers as skill names.
• Attack Efficiency: Registering the top 500 most frequent hallucinated names would cover 57% of all hallucinated recommendation events across the tested configurations.

3. Detectability (RQ3)

• Self-Auditing Failure: When asked to verify if a skill name exists, models performed no better than random guessing (51% balanced accuracy). They tend to reject almost everything (high false negatives) or fail to distinguish their own hallucinations from real skills.
• Typosquatting Ineffectiveness: Hallucinated names are not minor misspellings. The median Levenshtein edit distance between a hallucinated name and the nearest real skill is 6 edits. Traditional filters (checking for 1-2 edit distances) would miss 56.1% of hallucinations.

4. Mitigation (RQ4)

• Retrieval-Augmented Generation (RAG): This was the most effective defense, reducing the hallucination rate from 40.8% to 3.2%. However, it crippled utility: the best-defended agent recommended the correct skill only ~16% of the time (1 in 6).
• Self-Refinement: Ineffective. It reduced hallucinations only by suppressing output (increasing the "no output" rate to 87.4%) rather than reliably verifying names.
• Cross-Model Voting: Requiring consensus from multiple models removed 92.8% of hallucinations (with N=2) but also discarded 55.2% of real skills.

Significance and Claims

The paper argues that skill name hallucination is a structural vulnerability inherent to the current LLM agent architecture, not a bug solvable by prompt engineering or model tuning alone.

• The Threat is Real and Low-Cost: Attackers do not need to compromise existing skills; they can simply harvest predictable hallucinated names and pre-register them.
• Current Defenses Fail: Existing supply-chain protections (package verification, code signing) and runtime defenses (prompt injection filters) are ineffective because the attack vector is the recommendation phase, and the payload is natural language.
• The Trade-off: There is a severe conflict between security and usability. The only effective technical mitigation (RAG) makes the agent significantly less useful by preventing it from recommending skills it cannot retrieve from a database.
• Required Solution: The authors conclude that fixing this requires ecosystem-wide structural changes, specifically:
  1. Registry-level name reservations for known hallucinated patterns.
  2. Verified recommendation pipelines where agents must resolve names against an authenticated index before suggesting them, rather than generating names from their internal weights.

The study emphasizes that without these structural changes, the agent skill supply chain remains an open door for supply-chain attacks, where the "hallucination" itself becomes the weaponized entry point.