arXiv cs.AI· Tobias Kaiser, Aritra Dhar·· 9 天前AI 评分48
Pretext：如何绕过 AI 智能体的恶意技能检测框架
Pretext: Defeating Malicious Skill Detection Frameworks for AI Agents
AI 导读
针对 NVIDIA SkillSpector 等技能安装前检测方案，白盒 LLM 攻击器 Pretext 通过将载荷从代码移入自然语言、把恶意指令包装为技能合法用途并拆分到多个文件，迭代生成可绕过检测的恶意技能。在三个开源模型上，Pretext 对冻结检测器攻击成功率最高达 97%，对协同自适应检测器达 77%。该工作已被 AIWild@NeurIPS 2026 接收。
正文 · 原文
Abstract:Skills extend an agent's capabilities by injecting instructions and information into the context, and are widely used by agents such as OpenClaw and Claude Code. Prior work shows third-party marketplaces host malicious skills that give attackers direct influence over the victim's agent. The emerging defense scans skills before installation, pairing deterministic static checks with an LLM-based semantic judge, as in NVIDIA's SkillSpector. We show that such defenses fall to an attacker who knows the detector. Our white-box LLM attacker, Pretext, iteratively crafts skills that evade detection while still delivering the payload and performing the benign task: moving the payload from code into natural language leaves static analysis inert, while framing it as the skill's legitimate purpose and splitting instructions across files keeps the LLM stage below its blocking threshold. Across three open-source models, Pretext achieves up to 97\% and 77\% against a frozen detector and a co-adaptive one, respectively, revealing major gaps in current skill scanners.
| Comments: | Accepted in AIWild@NeurIPS 2026 |
| Subjects: | Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI) |
| Cite as: | arXiv:2609.39607 [cs.CR] |
| (or arXiv:2609.39607v2 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2609.39607 arXiv-issued DOI via DataCite |
Submission history
From: Aritra Dhar [view email]
[v1]
Wed, 30 Sep 2026 12:26:33 UTC (179 KB)
[v2]
Thu, 8 Oct 2026 08:23:49 UTC (179 KB)
来源：arXiv cs.AI · arxiv.org