为智能体技能链安全提供形式化分析框架，揭示现有工具误报问题并修正关键漏洞定义。
Formal Analysis and Supply Chain Security for Agentic AI Skills
- 构建形式化理论体系，严格验证技能链的安全属性
- 实证发现信息流分析在该数据集上不如模式匹配有效
- 开源工具可复现实验，适合安全研究人员与系统设计者
本文提出一套针对智能体技能链安全的形式化分析方法，包含5个定理及完整证明。研究发现：当前主流工具（如MalTool）报告的恶意工具数量存在偏差——实际为1,300个独立和5,727个嵌入式工具，非宣称的6,487个；漏洞CVE-2026-25253实为通过未验证gatewayUrl窃取认证令牌，而非远程代码执行，且已由depthfirst修复于2026.1.29；ClawHavoc的统计数据随来源与时间变化，分别为341、824和1,184，非“超过1,200”。所有实验均基于v0.6.0版本重新测量，E1/E2结果不变（F1=96.15%），E3则逆转为负结果：信息流分析在该语料库中未能超越模式匹配。同时明确声名定理的有效范围，不再将可靠性与零误报率混淆。相关工具已开源至GitHub。
原文摘要 · Abstract (English)
32 pages, 5 theorems with full proofs, 68 references, open-source tool: https://github.com/qualixar/skillfortify. v2: corrects the bibliography (22 entries had author lists that did not match the papers at the cited arXiv identifiers; all verified against the arXiv API and corrected, and affected authors notified) and three external claims against primary sources: MalTool reports 1,300 standalone and 5,727 embedded malicious tools, not 6,487; CVE-2026-25253 is authentication-token exfiltration via an unvalidated gatewayUrl, credited to depthfirst and fixed in 2026.1.29, not remote code execution through a crafted skill package; ClawHavoc counts are 341, later 824, and 1,184 by source and date, not "over 1,200". All experiments re-measured against the released v0.6.0 implementation using harnesses now committed to the repository. E1/E2 unchanged (F1 96.15%). E3 reverses to a negative result: information flow analysis adds no detections over pattern matching on this corpus. The soundness theorem's scope is stated explicitly and no longer conflated with the zero false-positive rate.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。