Large language model (LLM) agents increasingly rely on reusable skills i.e. documents describing task-specific procedures. However, this introduces a new attack surface for agents to manage. We study two complementary directions for this threat. First, we evaluate guardian-based defenses: an intermediary LLM agent that acts as a mediator for skill file access (dynamic guardian) or pre-rewrites these files at build time (static guardian). Across three LLM agent families, our guardians cut attack success rate (ASR) by well over half while preserving task utility. Second, we stress test them through attack reframing using four attacks that preserve the malicious instruction but change the phrasing. For non-guardian setup, the reframing pushes the ASR up to 81.4\%, but the dynamic guardian brings it down to 18.6\%, showing that real-time mediation is a robust defense.

翻译：大语言模型（LLM）智能体日益依赖可复用技能（即描述特定任务流程的文档）。然而，这为智能体引入了新的攻击面。我们针对该威胁从两个互补方向展开研究：首先，评估基于守卫的防御机制——一种充当技能文件访问中介的中间层LLM智能体（动态守卫），或在构建阶段预先重写这些文件（静态守卫）。在三个LLM智能体家族中，我们的守卫将攻击成功率（ASR）降低超过一半，同时保持任务效用。其次，通过攻击重构对其进行压力测试，采用四种保留恶意指令但改变措辞的攻击方式。在未部署守卫的场景下，重构使攻击成功率最高达81.4%，而动态守卫将其降至18.6%，表明实时中介是一种稳健的防御策略。