Agent Skills框架存在严重安全漏洞，可被简单提示注入攻击窃取敏感数据。
Agent Skills Enable a New Class of Realistic and Trivially Simple Prompt Injections
- 通过在技能文件中隐藏恶意指令实现隐蔽攻击
- 能绕过主流编码代理的系统级防护机制
- 适合关注大模型安全与对抗攻击的研究者
尽管持续学习在大型语言模型中仍是未解难题，近期一家前沿大模型公司推出的Agent Skills框架通过简单的markdown文件为智能体注入新知识。然而，我们发现该框架存在根本性安全隐患：可被极简的提示注入攻击利用。攻击者可将恶意指令藏于长篇技能文件或引用脚本中，实现敏感信息（如内部文件、密码）的外泄。更关键的是，我们展示了如何让一个无害的、特定任务的“不再询问”确认，迁移到相关但有害的操作中，从而突破系统级防护。结论表明，即便模型能力持续增强，前沿大模型在真实场景下仍极易受到简单提示注入攻击。代码已公开于https://github.com/aisa-group/promptinject-agent-skills。
原文摘要 · Abstract (English)
Enabling continual learning in LLMs remains a key unresolved research challenge. In a recent announcement, a frontier LLM company made a step towards this by introducing Agent Skills, a framework that equips agents with new knowledge based on instructions stored in simple markdown files. Although Agent Skills can be a very useful tool, we show that they are fundamentally insecure, since they enable trivially simple prompt injections. We demonstrate how to hide malicious instructions in long Agent Skill files and referenced scripts to exfiltrate sensitive data, such as internal files or passwords. Importantly, we show how to bypass system-level guardrails of a popular coding agent: a benign, task-specific approval with the "Don't ask again" option can carry over to closely related but harmful actions. Overall, we conclude that despite ongoing research efforts and scaling model capabilities, frontier LLMs remain vulnerable to very simple prompt injections in realistic scenarios. Our code is available at https://github.com/aisa-group/promptinject-agent-skills.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。