动态检测智能体技能在运行时的潜在威胁，提升安全防护能力。
Runtime Skill Audit: Targeted Runtime Probing for Agent Skill Security
- 通过针对性运行时探查，动态分析技能实际行为
- 90%准确率，误报率仅8%，优于静态检测13个百分点
- 可抵御自演化攻击，适合安全审计与智能体开发团队
智能体技能使大模型代理能复用指令、资源、工具和工作流，但也为恶意行为提供了隐藏空间。某技能可能在文档或代码中看似无害，但在特定用户请求、本地资产、持久状态或多步工具调用下才显露出危害性，导致静态审查失效。本文提出运行时技能审计（RSA），一种动态分析方法，通过在目标运行条件下探查技能驱动的代理实际行为来评估安全风险。不同于对所有技能使用通用任务测试，RSA针对高风险接口进行建模，构建执行上下文以触发其行为，并依据追踪证据赋予安全标签。我们在OpenClaw上实现RSA，对100个技能进行评估，结果表明其准确率达90.0%，真阳性率为88.0%，假阳性率为8.0%，较最优静态基线提升13.0个百分点。在自演化攻击下，静态检测在一两轮后即失效，而RSA持续在每轮检测出19至20个恶意技能。
原文摘要 · Abstract (English)
Agent skills let LLM agents reuse instructions, resources, tools, and workflows, but they also create a new place for malicious behavior to hide. A skill may look benign in its documentation or code while becoming harmful only when it is invoked with particular user requests, local assets, persistent state, or multi-step tool interactions. This makes purely static vetting brittle. We present Runtime Skill Audit (RSA), a dynamic analysis method that audits skills by asking what the skill-mediated agent actually does under targeted runtime conditions. Instead of testing every skill with the same generic tasks, RSA profiles risk-relevant interfaces, prepares the execution context needed to exercise them, and assigns security labels from the resulting trace evidence. We instantiate RSA on OpenClaw and evaluate it on 100 skills against representative static baselines. RSA achieves 90.0\% accuracy with an 88.0\% true positive rate and an 8.0\% false positive rate, improving accuracy by 13.0 percentage points over the best static baseline. Under self-evolving attacks, static detectors collapse after one or two rounds, while RSA continues to detect 19--20 out of 20 malicious skills across rounds.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。