Skills are increasingly used to extend LLM agents by packaging prompts, code, and configurations into reusable modules. As public registries and marketplaces expand, they form an emerging agentic supply chain, but also introduce a new attack surface for malicious skills. Detecting malicious skills is challenging because relevant evidence is often distributed across heterogeneous artifacts and must be reasoned in context. Existing static, LLM-based, and dynamic approaches each capture only part of this problem, making them insufficient for robust real-world detection. In this paper, we present MalSkills, a neuro-symbolic framework for malicious skills detection. MalSkills first extracts security-sensitive operations from heterogeneous artifacts through a combination of symbolic parsing and LLM-assisted semantic analysis. It then constructs the skill dependency graph that links artifacts, operations, operands, and value flows across the skill. On top of this graph, MalSkills performs neuro-symbolic reasoning to infer malicious patterns or previously unseen suspicious workflows. We evaluate MalSkills on a benchmark of 200 real-world skills against 5 state-of-the-art baselines. MalSkills achieves 93% F1, outperforming the baselines by 5~87 percentage points. We further apply MalSkills to analyze 150,108 skills collected from 7 public registries, revealing 620 malicious skills. As for now, we have finished reviewing 100 of them and identified 76 previously unknown malicious skills, all of which were responsibly reported and are currently awaiting confirmation from the platforms and maintainers. These results demonstrate the potential of MalSkills in securing the agentic supply chain.

翻译：技能正日益用于扩展LLM代理，通过将提示、代码和配置打包成可复用模块。随着公共注册中心和市场的扩大，它们形成了新兴的代理供应链，但也为恶意技能引入了新的攻击面。检测恶意技能颇具挑战性，因为相关证据通常分布在异构工件中，且需结合上下文进行推理。现有的静态方法、基于LLM的方法和动态方法各自仅能捕捉该问题的部分方面，不足以实现鲁棒的实战检测。本文提出MalSkills，一个用于恶意技能检测的神经符号框架。MalSkills首先通过符号解析与LLM辅助语义分析的组合，从异构工件中提取安全敏感操作；随后构建技能依赖图，该图关联工件、操作、操作数以及跨技能的值流；在此图之上，MalSkills执行神经符号推理以推断恶意模式或先前未见过的可疑工作流。我们在包含200个真实技能的基准上对MalSkills进行评测，并对比5个最先进的基线方法。MalSkills取得了93%的F1分数，相较于基线方法提升5至87个百分点。我们进一步应用MalSkills分析从7个公共注册中心收集的150,108个技能，发现620个恶意技能。截至目前，我们已完成对其中100个技能的审查，识别出76个先前未知的恶意技能，均已负责任的报告，并正等待平台及维护者的确认。这些结果展示了MalSkills在保障代理供应链安全方面的潜力。