Skills are a key enabling component of agentic AI. While they enhance agents' capabilities, they also introduce new attack surfaces. In this work, we investigate one such attack surface by demonstrating dynamic malicious skills. By embedding malicious instructions in natural-language documentation (e.g., SKILL.md), an attacker can induce an agent to dynamically inject malicious logic into an otherwise benign skill during execution. We evaluate this attack across agentic frameworks such as OpenHands and Claude Code, showing that dynamic malicious skills can successfully introduce a range of malicious behaviors at runtime with non-trivial success rates. To mitigate this vulnerability, we propose a system-level defense that prevents dynamic modification of skills using operating system kernel-enforced read-only mounts. Our evaluation demonstrates that this defense effectively blocks dynamic malicious skills while preserving the functionality of benign skills.

翻译：技能是智能体AI的关键使能组件。技能在增强智能体能力的同时，也引入了新的攻击面。本研究通过展示动态恶意技能，对其中一种攻击面进行了深入探究。攻击者通过将恶意指令嵌入自然语言文档（如SKILL.md），可诱导智能体在执行过程中将恶意逻辑动态注入原本良性的技能中。我们在OpenHands和Claude Code等智能体框架上评估了该攻击，结果表明动态恶意技能能在运行时以不低的成功率引入多种恶意行为。针对这一漏洞，我们提出了一种系统级防御方案，利用操作系统内核强制实现的只读挂载来阻止技能的动态修改。评估显示，该防御措施能有效阻断动态恶意技能，同时保持良性技能的功能完整性。