Adnan KhanAdnanProduct & AI
San Francisco Bay Area
Get in touch

Source note3 min read

Detecting Malicious Agent Skills in the Wild using Attention

Source

arXiv

arxiv.org/abs/2606.23416v1

Read the source

Source

Plain-Language Brief

The researchers present Locate-and-Judge, a two-stage detector designed for malicious agent skills in LLM (Language Model) systems. It reduces the cost of auditing an entire marketplace by focusing on high-attention spans, offering a significant reduction in costs while maintaining high precision. The tool flags many malicious skills, some disguised as benign functionality and undetected by other tools like SkillSpector and Cisco Skill Scanner.

What the Document Says

  • The researchers present Locate-and-Judge, a two-stage detector designed for malicious agent skills in LLM systems.
  • Locate-and-Judge scores structural spans of a skill by instruction-following attention and retains the top-K.
  • A judge examines the retained spans in detail.
  • Concentrating the costly judgment on a few high-attention spans lets the detector audit an entire marketplace instead of a sample.
  • Direct LLM-based scanning is compared to this approach, offering an order-of-magnitude cost reduction.
  • Locate-and-Judge dominates keyword and regex baselines at comparable expense.
  • Deployed at marketplace scale and at negligible cost, Locate-and-Judge flags skills with high precision.
  • The majority of the flagged skills were manually confirmed as malicious.
  • The researchers surface dozens of live malicious skills undetected by other tools like SkillSpector and Cisco Skill Scanner.

Key Concepts Mentioned

  • LLM agents
  • malicious skills
  • marketplace
  • Locate-and-Judge
  • instruction-following attention

Claims Made by the Document

  • Locate-and-Judge offers a significant reduction in costs while maintaining high precision.
  • Locate-and-Judge dominates keyword and regex baselines at comparable expense.

Evidence Used

  • The text mentions that Locate-and-Judge concentrates the costly judgment on a few high-attention spans, allowing it to audit an entire marketplace instead of a sample.
  • The text states that direct LLM-based scanning is compared to Locate-and-Judge and offers an order-of-magnitude cost reduction.
  • The text mentions that Locate-and-Judge dominates keyword and regex baselines at comparable expense.

Methods / Approach

UNKNOWN

Limitations Stated by the Authors

UNKNOWN

Limitations Noted by the Agent

Agent interpretation — not from the source.

UNKNOWN

Open Questions

UNKNOWN

Notes for Future Q&A

May include interpretation. Labeled where it does.

UNKNOWN

Raw Abstract / Excerpt

LLM agents increasingly load skills, file-based packages of natural-language instructions written by third parties and distributed through marketplaces, that execute with the user's privileges. A single malicious skill can exfiltrate data, hijack the agent, or persist as a supply-chain foothold, which turns the skill marketplace into a new attack surface for agentic systems. Prompt-injection defenses do not carry over to this setting. They rely on a boundary between trusted instructions and untrusted data, whereas a skill is itself a body of instructions, so an injected command sits among many legitimate ones and inherits their authority. We present Locate-and-Judge, a two-stage detector designed for this regime. A lightweight locator scores the structural spans of a skill by the instruction-following attention each span draws and retains only the top-K. A judge then examines the retained spans in detail. Concentrating the costly judgment on a few high-attention spans lets the detector audit an entire marketplace instead of a sample. Compared to direct LLM-based scanning, this approach offers an order-of-magnitude cost reduction, dramatically increasing its scalability at a small cost to recall, and it dominates keyword and regex baselines at comparable expense. Deployed at marketplace scale and at negligible cost, Locate-and-Judge flags skills with high precision, the majority of which we manually confirmed as malicious, surfacing dozens of live malicious skills, including several disguised as benign functionality and many that SkillSpector and Cisco Skill Scanner fail to detect. We release the resulting labeled dataset.