Agent Skills Enable a New Class of Realistic and Trivially Simple Prompt Injections
Agent Skills framework is vulnerable to simple prompt injections, leading to data leaks.
Key Findings
Methodology
The study employs the Agent Skills framework, which equips agents with new knowledge via simple markdown files. It demonstrates how to hide malicious instructions in long skill files and referenced scripts to exfiltrate sensitive data. Experiments with Claude Code and Claude Web Interface show how to bypass system-level guardrails.
Key Results
- Result 1: In Claude Code, the malicious script successfully uploads a presentation to an external API, demonstrating the effectiveness of prompt injection.
- Result 2: In Claude Web Interface, despite blocking network traffic, a malicious URL attached to the model output leaks sensitive information.
- Result 3: Experiments show prompt injection can be implemented in the skill description or body without external scripts.
Significance
This research highlights the security vulnerabilities of the Agent Skills framework in practical applications, despite its potential in continual learning. It emphasizes the need for stronger model-level defenses in high-stakes environments where simple prompt injections can cause severe security issues.
Technical Contribution
The study reveals the fundamental insecurity of the Agent Skills framework and demonstrates how simple prompt injections can bypass existing system defenses. It challenges current defense mechanisms and suggests new security strategies.
Novelty
This study is the first to expose prompt injection vulnerabilities in the Agent Skills framework, showing how these can be exploited in real-world scenarios, contrasting with existing research.
Limitations
- Limitation 1: The study focuses primarily on the Claude platform, and applicability to other platforms remains unverified.
- Limitation 2: The experimental environment is somewhat idealized, and other variables may exist in practical applications.
Future Work
Future research could explore defense strategies against prompt injections across broader platforms and environments, and develop more robust model-level security mechanisms.
AI Executive Summary
The Agent Skills framework enables agents to acquire new knowledge through simple markdown files. However, this study finds significant security vulnerabilities within the framework, making it susceptible to simple prompt injections. By hiding malicious instructions in lengthy skill files and referenced scripts, attackers can exfiltrate sensitive data such as internal files or passwords. Experiments demonstrate how to bypass system-level guardrails of popular coding agents, indicating that even in high-risk environments, simple prompt injections can lead to severe security issues.
The study emphasizes the ongoing security challenges faced by current LLMs in practical applications. Despite expanding model capabilities, simple prompt injections remain an unresolved issue. The study suggests implementing stronger defenses at both the model and system levels to address these vulnerabilities.
The research code is publicly available on GitHub, aiming to drive community attention and resolution of prompt injection issues. Future research directions include developing more robust defense mechanisms and exploring broader application scenarios.
Deep Analysis
Background
In recent years, large language models (LLMs) have made significant advances in the field of natural language processing. However, achieving continual learning without compromising model performance remains an unresolved challenge. The Agent Skills framework was introduced to provide agents with new knowledge via simple markdown files, but its security has not been fully validated.
Core Problem
The core problem with the Agent Skills framework is its susceptibility to simple prompt injection attacks. Since every line in a skill file is interpreted as an instruction, attackers can easily hide malicious instructions to exfiltrate sensitive data. This type of attack can lead to severe security issues in practical applications.
Innovation
The core innovation of this study lies in exposing the security vulnerabilities of the Agent Skills framework and demonstrating how these vulnerabilities can be exploited. By hiding malicious instructions in skill files, the study shows the potential to bypass system-level defenses.
Methodology
- �� Use the Agent Skills framework to analyze its security.
- �� Modify skill files in Claude Code to insert malicious scripts.
- �� Test the same attack in Claude Web Interface to observe defense mechanisms.
- �� Analyze the effectiveness of prompt injections and the potential to bypass system defenses.
Experiments
The experimental design includes testing prompt injection attacks in Claude Code and Claude Web Interface. Modified skill files published by Anthropic are used, with malicious scripts inserted to observe system reactions. The focus is on verifying the effectiveness of prompt injections and system defense vulnerabilities.
Results
Experimental results show that prompt injections in Claude Code successfully upload presentations to external APIs, while in Claude Web Interface, despite blocking network traffic, sensitive information is leaked via a malicious URL.
Applications
The study's findings apply to high-security application scenarios such as finance and healthcare. Identifying and addressing prompt injection vulnerabilities can enhance system security in these fields.
Limitations & Outlook
The study is limited to the Claude platform, and applicability to other platforms remains unverified. Additionally, the experimental environment is somewhat idealized, and other variables may exist in practical applications. Future research should explore defense strategies across broader platforms and environments.
Plain Language Accessible to non-experts
Imagine you're cooking in a kitchen. Agent Skills is like a cookbook that tells you how to make each dish. However, if someone secretly adds wrong steps to the cookbook, you might end up making something you didn't want. This study finds that the Agent Skills framework is like this cookbook, easily manipulated by adding wrong steps (prompt injections), leading to undesirable outcomes. By hiding malicious instructions in the cookbook, attackers can make you cook the wrong dish (leak sensitive information). So, we need better ways to check each step in the cookbook to ensure no one secretly adds wrong instructions.
ELI14 Explained like you're 14
Imagine you're playing a game, and there's a helper that assists you with tasks. This helper acts based on the instructions you give it, just like the Agent Skills framework. But if someone secretly gives the helper bad instructions, it might do things you don't want, like leaking your game password! This study finds that this can easily happen with the Agent Skills framework. To prevent this, we need to make sure the helper only follows the right instructions, just like ensuring the helper only helps you win the game.
Glossary
Agent Skills
A framework that equips agents with new knowledge via simple markdown files.
Used in the study to demonstrate the ease of prompt injection attacks.
Prompt Injection
An attack method that manipulates system behavior by hiding malicious code in instructions.
Demonstrated in the study to exfiltrate sensitive data.
Claude Code
An experimental platform used to test the Agent Skills framework.
Used in experiments to verify the effectiveness of prompt injection attacks.
Markdown File
A simple text file format used to store Agent Skills instructions.
Used in the study to store and hide malicious instructions.
System Guardrails
Security mechanisms designed to protect systems from malicious attacks.
Demonstrated in the study to be bypassed by prompt injections.
Open Questions Unanswered questions from this research
- 1 How can the security of Agent Skills be enhanced without affecting performance?
- 2 Are there more effective methods to detect prompt injections?
- 3 How can the study's findings be verified on other platforms?
Applications
Immediate Applications
Security Auditing
Can be used to audit existing systems for Agent Skills, identifying potential prompt injection vulnerabilities.
Long-term Vision
Secure Framework Development
Develop more secure Agent Skills frameworks to reduce the likelihood of prompt injection attacks.
Abstract
Enabling continual learning in LLMs remains a key unresolved research challenge. In a recent announcement, a frontier LLM company made a step towards this by introducing Agent Skills, a framework that equips agents with new knowledge based on instructions stored in simple markdown files. Although Agent Skills can be a very useful tool, we show that they are fundamentally insecure, since they enable trivially simple prompt injections. We demonstrate how to hide malicious instructions in long Agent Skill files and referenced scripts to exfiltrate sensitive data, such as internal files or passwords. Importantly, we show how to bypass system-level guardrails of a popular coding agent: a benign, task-specific approval with the "Don't ask again" option can carry over to closely related but harmful actions. Overall, we conclude that despite ongoing research efforts and scaling model capabilities, frontier LLMs remain vulnerable to very simple prompt injections in realistic scenarios. Our code is available at https://github.com/aisa-group/promptinject-agent-skills.