Agentic AI
Researchers Develop Framework to Hunt Malicious AI Agent Skills Across Public Registries
A new technique combining symbolic reasoning and machine learning can detect dangerous code packages in the growing ecosystem of LLM agent extensions, flagging hundreds of threats already in circulation.
As large language model agents become more powerful, they increasingly rely on "skills"—reusable modules that package prompts, code, and settings together—to extend their capabilities. But this emerging ecosystem of public skill registries and marketplaces has opened a new door for attackers looking to inject malicious code into production AI systems.
A team of researchers has introduced MalSkills, a detection framework designed to spot these dangerous skills before they cause harm. The work highlights a growing security blind spot in the agentic supply chain.
The Detection Challenge#
Identifying malicious skills is particularly difficult because the evidence of an attack is often scattered across different files and formats—code snippets, configuration files, documentation, and prompt templates. Static analysis alone misses semantic intent, while purely LLM-based detection struggles with context and technical rigor. Traditional dynamic testing can be time-consuming and incomplete.
MalSkills tackles this by combining symbolic reasoning (precise rule-based parsing) with neural reasoning (LLM-powered semantic understanding) to reconstruct a complete picture of what a skill does.
How It Works#
The framework operates in stages. First, it extracts security-sensitive operations from a skill's various artifacts—parsing code directly while using language models to understand the intent buried in prompts and configurations. It then constructs a dependency graph that traces how data flows through the skill, linking operations, variables, and value transformations.
Finally, MalSkills applies neuro-symbolic reasoning on top of this graph to detect known malicious patterns as well as novel suspicious workflows that haven't been seen before.
Real-World Results#
In testing on 200 genuine skills, MalSkills achieved 93% F1 score—significantly outperforming five existing approaches by 5 to 87 percentage points. More critically, researchers scanned 150,108 skills across seven public registries and flagged 620 as potentially malicious. Manual review confirmed that 400 of those are indeed harmful, and all have been responsibly reported to the relevant platforms and maintainers for verification and removal.
