@inproceedings{duan-etal-2026-skillattack,
title = "{S}kill{A}ttack: Automated Red Teaming of Agent Skills through Attack Path Refinement",
author = "Duan, Zenghao and
Tian, Yuxin and
Yin, Zhiyi and
Pang, Liang and
Deng, Jingcheng and
Duan, Wenbin and
Ge, Yuyao and
Wei, Zihao and
Xu, Shicheng and
Cheng, Xueqi",
editor = "Lee, Hung-Yi and
Dev, Sunipa and
Li, Jessy and
Elliott, Desmond",
booktitle = "Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing",
month = oct,
year = "2026",
address = "Budapest, Hungary",
publisher = "Association for Computational Linguistics",
url = "https://aclanthology.org/2026.emnlp-main.1926/",
pages = "43859--43872",
ISBN = "979-8-89176-459-0",
abstract = "LLM-based agent systems increasingly rely on open-registry skills, which are difficult to vet and expose agents to greater attack risks. These attacks mainly take two forms. Malicious injection attacks embed explicit harmful instructions into skills and are readily caught by auditing. Direct vulnerability attacks target latent flaws in non-malicious skills; however, directly crafted attack prompts often lead to unstable or unverified outcomes. We introduce **SkillAttack**, an automated red-teaming framework that systematically explores executable attack paths from latent vulnerabilities without modifying skill files. Evaluated across 11 target LLMs, SkillAttack substantially outperforms baselines, showing that well-intended skills can pose serious risks in realistic agent interactions. Our evaluation also yields trajectory-level attack traces with verified risk labels, providing a foundation for defense. We also release **SkillRiskBench**, a benchmark for skill risk analysis, and train a lightweight pre-execution risk guard that predicts risky invocations from the user request and skill file. The guard outperforms frontier LLM judges and existing safety guard models, highlighting the value of trajectory-grounded supervision for proactive skill defense. Code is available at https://github.com/Zhow01/SkillAttack."
}<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="duan-etal-2026-skillattack">
<titleInfo>
<title>SkillAttack: Automated Red Teaming of Agent Skills through Attack Path Refinement</title>
</titleInfo>
<name type="personal">
<namePart type="given">Zenghao</namePart>
<namePart type="family">Duan</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Yuxin</namePart>
<namePart type="family">Tian</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Zhiyi</namePart>
<namePart type="family">Yin</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Liang</namePart>
<namePart type="family">Pang</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Jingcheng</namePart>
<namePart type="family">Deng</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Wenbin</namePart>
<namePart type="family">Duan</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Yuyao</namePart>
<namePart type="family">Ge</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Zihao</namePart>
<namePart type="family">Wei</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Shicheng</namePart>
<namePart type="family">Xu</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Xueqi</namePart>
<namePart type="family">Cheng</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<originInfo>
<dateIssued>2026-10</dateIssued>
</originInfo>
<typeOfResource>text</typeOfResource>
<relatedItem type="host">
<titleInfo>
<title>Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing</title>
</titleInfo>
<name type="personal">
<namePart type="given">Hung-Yi</namePart>
<namePart type="family">Lee</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Sunipa</namePart>
<namePart type="family">Dev</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Jessy</namePart>
<namePart type="family">Li</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Desmond</namePart>
<namePart type="family">Elliott</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<originInfo>
<publisher>Association for Computational Linguistics</publisher>
<place>
<placeTerm type="text">Budapest, Hungary</placeTerm>
</place>
</originInfo>
<genre authority="marcgt">conference publication</genre>
<identifier type="isbn">979-8-89176-459-0</identifier>
</relatedItem>
<abstract>LLM-based agent systems increasingly rely on open-registry skills, which are difficult to vet and expose agents to greater attack risks. These attacks mainly take two forms. Malicious injection attacks embed explicit harmful instructions into skills and are readily caught by auditing. Direct vulnerability attacks target latent flaws in non-malicious skills; however, directly crafted attack prompts often lead to unstable or unverified outcomes. We introduce **SkillAttack**, an automated red-teaming framework that systematically explores executable attack paths from latent vulnerabilities without modifying skill files. Evaluated across 11 target LLMs, SkillAttack substantially outperforms baselines, showing that well-intended skills can pose serious risks in realistic agent interactions. Our evaluation also yields trajectory-level attack traces with verified risk labels, providing a foundation for defense. We also release **SkillRiskBench**, a benchmark for skill risk analysis, and train a lightweight pre-execution risk guard that predicts risky invocations from the user request and skill file. The guard outperforms frontier LLM judges and existing safety guard models, highlighting the value of trajectory-grounded supervision for proactive skill defense. Code is available at https://github.com/Zhow01/SkillAttack.</abstract>
<identifier type="citekey">duan-etal-2026-skillattack</identifier>
<location>
<url>https://aclanthology.org/2026.emnlp-main.1926/</url>
</location>
<part>
<date>2026-10</date>
<extent unit="page">
<start>43859</start>
<end>43872</end>
</extent>
</part>
</mods>
</modsCollection>
%0 Conference Proceedings
%T SkillAttack: Automated Red Teaming of Agent Skills through Attack Path Refinement
%A Duan, Zenghao
%A Tian, Yuxin
%A Yin, Zhiyi
%A Pang, Liang
%A Deng, Jingcheng
%A Duan, Wenbin
%A Ge, Yuyao
%A Wei, Zihao
%A Xu, Shicheng
%A Cheng, Xueqi
%Y Lee, Hung-Yi
%Y Dev, Sunipa
%Y Li, Jessy
%Y Elliott, Desmond
%S Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing
%D 2026
%8 October
%I Association for Computational Linguistics
%C Budapest, Hungary
%@ 979-8-89176-459-0
%F duan-etal-2026-skillattack
%X LLM-based agent systems increasingly rely on open-registry skills, which are difficult to vet and expose agents to greater attack risks. These attacks mainly take two forms. Malicious injection attacks embed explicit harmful instructions into skills and are readily caught by auditing. Direct vulnerability attacks target latent flaws in non-malicious skills; however, directly crafted attack prompts often lead to unstable or unverified outcomes. We introduce **SkillAttack**, an automated red-teaming framework that systematically explores executable attack paths from latent vulnerabilities without modifying skill files. Evaluated across 11 target LLMs, SkillAttack substantially outperforms baselines, showing that well-intended skills can pose serious risks in realistic agent interactions. Our evaluation also yields trajectory-level attack traces with verified risk labels, providing a foundation for defense. We also release **SkillRiskBench**, a benchmark for skill risk analysis, and train a lightweight pre-execution risk guard that predicts risky invocations from the user request and skill file. The guard outperforms frontier LLM judges and existing safety guard models, highlighting the value of trajectory-grounded supervision for proactive skill defense. Code is available at https://github.com/Zhow01/SkillAttack.
%U https://aclanthology.org/2026.emnlp-main.1926/
%P 43859-43872
Markdown (Informal)
[SkillAttack: Automated Red Teaming of Agent Skills through Attack Path Refinement](https://aclanthology.org/2026.emnlp-main.1926/) (Duan et al., EMNLP 2026)
ACL
- Zenghao Duan, Yuxin Tian, Zhiyi Yin, Liang Pang, Jingcheng Deng, Wenbin Duan, Yuyao Ge, Zihao Wei, Shicheng Xu, and Xueqi Cheng. 2026. SkillAttack: Automated Red Teaming of Agent Skills through Attack Path Refinement. In Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing, pages 43859–43872, Budapest, Hungary. Association for Computational Linguistics.