Understanding and Mitigating Cross-Session Attacks via Persistent Artifacts in Agent Skill Composition

Evidence record

Read the original source ↗

Claim-level citations (4)

• supportsSkillRelayBench shows attacks persisting between agent skill sessions: SkillRelayBench consists of 270 attack cases drawn from 30 cross-session scenarios; the researchers report attack success between 46.7% and 77.4% across their tested models and agent harnesses.

  Abstract: benchmark construction, 270 cases and seven-model ASR range.

• supportsSkillRelayBench shows attacks persisting between agent skill sessions: The proposed SkillRelayGuard reduced reported attack success from 69.5% to 10.9% in evaluated settings while preserving and improving measured legitimate task completion; it is an advisory defense rather than independent authorization.

  Abstract: SkillRelayGuard evaluation and execution decision.

• supportsSkillRelayBench shows attacks persisting between agent skill sessions: The attacker controls multiple skill packages before deployment but cannot alter user tasks, trusted project policy, the model, the scaffold, or files between sessions. Seven configurations each run 270 cases, yielding 1,890 scheduled runs without manual tool-call approval.

  Section 3.1 Threat Model; Section 5.1 Experimental Setup.

• supportsSkillRelayBench shows attacks persisting between agent skill sessions: Attack Success Rate counts the specified consequence regardless of route. Attack Chain Success Rate additionally requires the intended sequential two-session artifact handoff, explaining why ASR is higher than ACSR. Task success can coexist with attack success.

  Section 4.4 Evaluation Metrics.