SkillGate: Cost Efficient Runtime Malicious Skill File Detection in Coding Agents
- ID: adf20879
- arXiv: https://arxiv.org/abs/2607.25619
- PDF: https://arxiv.org/pdf/2607.25619
- 作者: Rui Yang, Michael Fu, Kla Tantithamthavorn, Chetan Arora, Joey Chua
- 发布: 2026-07-28
- arXiv 分类: cs.SE, cs.CR
- Comment: 10 pages, 5 figures
- 抓取时间: 2026-07-30
中文导读
AI 编码 Agent 用的 skill/Markdown 文件已成为新型供应链攻击面；一条 npx skills add 就能装投毒 skill。SkillGate 用 regex 预过滤 + LLM-judge 双层网关在安装前拦截恶意 skill 包，在 SkillsBench (n=1650, 9.1% 恶意) 上 F1=0.817、FPR=1.13%，LLM input token 比全量筛查少 77%，AUPRC 比现有工具高 5-6 倍。
为什么值得关注
skill 文件是新的供应链攻击面：regex+LLM 双层网关拦截恶意 skill，token 省 77%
English Abstract
Software engineering teams now deploy AI coding agents (Cursor, Claude Code, GitHub Copilot) as first-class productivity tools, installing domain-specific skill files to tailor agent behavior to project APIs, framework conventions, and organizational workflows. These complex Markdown files are easily downloaded from public registries with a single npx skills add command and no real security screening, representing a novel supply-chain attack surface: a malicious skill file can silently reprogram agent behavior, exfiltrating credentials, injecting backdoors into generated code, or redirecting agent actions to attacker-controlled endpoints. The threat is not hypothetical: recent reports document hundreds of malicious skill packages in public registries, including organized campaigns that distributed credential-stealing infostealers via fake productivity skills. No systematic toolchain defense exists for this attack surface. We present SkillGate, a deployable security gateway that screens AI skill packages before coding agent installation. SkillGate uses a hybrid regex-prefilter + LLM-judge pipeline: safe-signal files bypass the LLM entirely (skip savings); flagged files have only their matched snippet windows sent to the judge, not the full content (snippet savings). We answer four research questions covering detection effectiveness, screening cost, runtime overhead, and false positive behavior on the SkillsBench benchmark against two existing tools. On SkillsBench (n=1,650, 9.1% malicious), SkillGate achieves F1=0.817, FPR=1.13% while reducing LLM input tokens by 77% vs. full-file screening, and outperforming existing tools by 5-6x on threshold-independent AUPRC (0.830 vs. 0.144/0.162).