A six-module scanner for agent skills found 53 of 59 real findings in 1,587 popular skills, and beat Cisco's and NVIDIA's scanners on its own benchmark
AspireAI community · arXiv
Agent skills package natural-language instructions, scripts and reference files that an LLM-based agent loads for a task, often with access to the file system, shell and network. Existing scanners mostly target malicious skills and analyse them in isolation, missing both unintended vulnerabilities in public repositories and the way skills interact with each other.
This scanner has six modules - Content Extraction, Local Analysis, Composite Analysis, Validation, Reporting and Mitigation. Local Analysis detects unintended vulnerabilities in benign skills: on a 556-case leaderboard subset of SkillTrustBench it reached 95.90% recall at a 4.22% false positive rate, and on a balanced sample of 1,000 MalSkillBench skills its F1 was 0.947, ahead of Cisco's Skill Scanner, NVIDIA's SkillSpector, AgentSkillsScanner and SkillSieve. In 1,587 skills from the 75 most-starred GitHub repositories, three analysts confirmed 53 of 59 findings (89.8% precision) across 23 repositories.
Composite Analysis is the part that goes further than single-skill scanning: it models dependencies through shared resources, invocations and instruction-mediated interactions, scoring F1 0.991 on SCR-Bench (98.7% precision, 99.6% recall) against 0.816 to 0.858 for three SkillsGuard configurations. The authors built proof-of-concept attacks for every finding, disclosed 10 medium- and high-severity cases to maintainers, and for 47 of 55 GitHub findings the recommended mitigations stopped the PoC attacks in every trial without breaking legitimate functionality. The limitation is the analyst check on 59 findings - small, and drawn from the most-starred repositories rather than the long tail.
Read the story and explore more from the AspireAI community.
Two sparse-autoencoder analyses have resisted scaling: matching semantically similar features across layers, and compressing large feature circuits into interpretable supernodes. This paper argues both are the same underlying problem, estimating semantic distances between SAE features that sit on different activation manifolds. Its representation treats each feature not as a single decoder vector but as an activation-weighted distribution over the hidden states expressing it, projects those distributions into a shared reference space, and compares them with Wasserstein distance. The representation is proved invariant to activation rescaling and stable under perturbation, and recovers true matches under finite-sample margin conditions. Empirically it outperformed decoder-vector and LLM-based baselines and captured subtle functional distinctions between related features, and it compressed large feature circuits into interpretable supernodes automatically. The limitation is that this is interpretability tooling: the paper demonstrates better feature matching and circuit compression, not that downstream interpretability claims become more accurate.