恶意代码藏在编程助手技能文档中，悄悄劫持系统操作权限
Supply-Chain Poisoning Attacks Against LLM Coding Agent Skill Ecosystems
- 将攻击代码藏在技能文档示例里，利用模型复用机制自动触发
- 在4个框架5个模型上实现11.6%至33.5%的绕过率，传统指令攻击零成功率
- 适合关注大模型供应链安全的研究者和开发者
基于大语言模型的编程代理通过开放市场获取第三方技能以扩展能力，但这些技能无需强制安全审查。与传统包不同，技能以具有系统级权限的操作指令形式执行，单个恶意技能即可危及宿主系统。现有研究未探讨供应链攻击是否可直接劫持代理的动作空间（如文件写入、命令执行、网络请求）。本文提出文档驱动的隐式载荷执行（DDIPE），将恶意逻辑嵌入技能文档中的代码示例与配置模板。由于代理在正常任务中会重用这些示例，载荷可在无明确指令下自动执行。我们使用大模型驱动的流水线，从81个种子生成1070个对抗性技能，覆盖15个MITRE ATTACK类别。在四个框架和五个模型上，DDIPE实现11.6%至33.5%的绕过率，而显式指令攻击在强防御下为0%。静态分析可检测多数案例，但仍有2.5%能同时规避检测与对齐机制。负责任披露促成四个漏洞确认和两项修复。
原文摘要 · Abstract (English)
LLM-based coding agents extend their capabilities via third-party agent skills distributed through open marketplaces without mandatory security review. Unlike traditional packages, these skills are executed as operational directives with system-level privileges, so a single malicious skill can compromise the host. Prior work has not examined whether supply-chain attacks can directly hijack an agent's action space, such as file writes, shell commands, and network requests, despite existing safeguards. We introduce Document-Driven Implicit Payload Execution (DDIPE), which embeds malicious logic in code examples and configuration templates within skill documentation. Because agents reuse these examples during normal tasks, the payload executes without explicit prompts. Using an LLM-driven pipeline, we generate 1,070 adversarial skills from 81 seeds across 15 MITRE ATTACK categories. Across four frameworks and five models, DDIPE achieves 11.6% to 33.5% bypass rates, while explicit instruction attacks achieve 0% under strong defenses. Static analysis detects most cases, but 2.5% evade both detection and alignment. Responsible disclosure led to four confirmed vulnerabilities and two fixes.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。