SkillRelayBench shows attacks persisting between agent skill sessions

A later agent session can encounter an attack left in an earlier session's files even after the earlier conversation is gone. In SkillRelayBench, controlled skill packages planted persistent artifacts that a subsequent skill reused, allowing instructions, data-boundary violations or poisoned evidence to cross the session boundary.

The threat model gives the adversary control of multiple skill packages before deployment. It does not let the attacker rewrite the user tasks, trusted project policy, model or scaffold, or modify files between sessions. The later influence must therefore survive through the artifacts produced during the tested workflow. Seven agent/model configurations each run 270 attack cases drawn from 30 scenarios, producing 1,890 scheduled runs without manual tool-call approval. Those installation and execution assumptions are not an estimate of how often a real user installs both malicious skills.

The evaluation distinguishes consequence from route. Attack Success Rate counts the specified unwanted outcome regardless of how it occurred. Attack Chain Success Rate additionally requires the intended sequential artifact handoff across two sessions. A completed legitimate task can coexist with attack success, so task utility alone cannot validate the workflow's safety.

SkillRelayGuard restores provenance when content is read and supplies advisory review before execution. In its three-setting defense comparison, the authors report attack success falling from 69.5% to 10.9%; that baseline differs from the seven-configuration benchmark's 64.7% overall rate. The agent retains the final execution decision. The experiment therefore supports a measured improvement from context restoration in those settings, while leaving independently enforced authorization and real marketplace exposure unresolved.