Agent skills occupy a privileged position in the agent workflow, as agents are expected to implicitly follow and execute them, rendering third-party skills a vulnerable attack surface. Existing studies have revealed unsafe agent behaviors induced by skill-based attacks, but they primarily evaluate poisoned skills within a single task execution and enumerate harms through ad hoc risk lists. To bridge these gaps, we introduce SkillHarm, a benchmark for evaluating skill-based attacks across the skill-use lifecycle, paired with a systematic taxonomy of skill-relevant risks. SkillHarm evaluates two attack scenarios: Fixed-Payload Poisoning (FPP), where a fixed poisoned skill package directly compromises any task session that invokes it, and Self-Mutating Poisoning (SMP), where an initially benign execution silently mutates persistent skill content, deferring harm until a subsequent reuse. It further defines 12 risk types based on the agent workflow component targeted by the harm: data pipelines, system environments, and agent autonomy. To instantiate these attacks at scale, we build an automated construction pipeline using coding agents driven by natural-language harnesses. The resulting benchmark contains 879 attack samples across 71 skills. Experiments show that current agents remain vulnerable with attack success rates up to 86.3% in FPP and 69.3% in SMP. Our analysis further reveals a latent risk: many apparent attack failures stem from the agent failing to engage with the poisoned file rather than genuine resistance, and current defenses still fail to reliably mitigate the threat.

Unified Multi-Modal Generation (UMMG) models support seamless switching between generation tasks spanning multiple modality combinations within a single conversational interface. However, existing safety benchmarks construct prompts independently per modality, so different modalities cover different harmful intentions, preventing holistic evaluation of UMMG models. We propose an intention-grounded evaluation methodology in which every modality combination is evaluated against the same set of harmful intentions, yielding fair, directly comparable safety scores across modalities. Because scores are aggregated at the intention level — averaging over the same set of intentions rather than over modality-specific prompt sets — each model receives an accurate safety profile not distorted by per-modality differences. The methodology is incrementally extensible: new modality combinations or intentions can be added without rebuilding existing data. Following this methodology, we construct UNISAF-Bench (UNIfied intention-grounded SAFety Benchmark): 1,257 human-verified harmful intentions across 19 policies, yielding 20,112 conversations spanning 4 modality combinations, single-/multi-turn settings, and paired policy-violating/boundary-benign variants. Evaluation of four open-source UMMG models reveals systematic safety gaps: multimodal inputs degrade text-output safety, safety alignment fails to transfer to image generation, and multi-turn deflection bias inflates refusal on both harmful and benign prompts.

In commercial dialogue systems, the Spoken Language Understanding (SLU) component tends to have numerous domains thus context is needed to help resolve ambiguities. Previous works that incorporate context for SLU have mostly focused on domains where context is limited to a few minutes. However, there are domains that have related context that could span up to hours and days. In this paper, we propose temporal representations that combine wall-clock second difference and turn order offset information to utilize both recent and distant context in a novel large-scale setup. Experiments on the Contextual Domain Classification (CDC) task with various encoder architectures show that temporal representations combining both information outperforms only one of the two. We further demonstrate that our contextual Transformer is able to reduce 13.04% of classification errors compared to a non-contextual baseline. We also conduct empirical analyses to study recent versus distant context and opportunities to lower deployment costs.