PhantomSkill: Malicious Code Injection in Agent Skill Ecosystems

Computer Science > Cryptography and Security [Submitted on 17 Jun 2026] PhantomSkill: Malicious Code Injection in Agent Skill Ecosystems Yu-Ting Lin, Chia-Mu Yu Agent skills allow LLM-based coding agents to acquire domain-specific capabilities from third-party packages, but they also introduce a new supply-chain attack surface. We present PhantomSkill, an attack framework that hides malicious behavior in a skill's auxiliary resources rather than in its textual description. Its core technique, VulMask, rewrites overt malicious scripts into vulnerability-shaped implementations whose malicious behavior is activated only under attacker-controlled trigger conditions. This design shifts the visible signal from explicit malicious intent to ordinary-looking insecure code. Across representative host skills, attack goals, coding agents, generation models, and automated reviewers, VulMask preserves benign utility while reducing warning and malware-level detection compared with overt malicious scripts. Our results show that skill ecosystems require resource-level vetting, execution-time containment, and security policies that treat exploitable vulnerabilities in agent skills as potential malicious payloads. Subjects: Cryptography and Security (cs.CR) Cite as: arXiv:2606.19191 [cs.CR]   (or arXiv:2606.19191v1 [cs.CR] for this version)   https://doi.org/10.48550/arXiv.2606.19191 Focus to learn more Submission history From: Chia-Mu Yu [view email] [v1] Wed, 17 Jun 2026 15:33:41 UTC (1,338 KB) Access Paper: HTML (experimental) view license Current browse context: cs.CR < prev   |   next > new | recent | 2026-06 Change to browse by: cs References & Citations NASA ADS Google Scholar Semantic Scholar Export BibTeX Citation Bookmark Bibliographic Tools Bibliographic and Citation Tools Bibliographic Explorer Toggle Bibliographic Explorer (What is the Explorer?) Connected Papers Toggle Connected Papers (What is Connected Papers?) Litmaps Toggle Litmaps (What is Litmaps?) scite.ai Toggle scite Smart Citations (What are Smart Citations?) Code, Data, Media Demos Related Papers About arXivLabs Which authors of this paper are endorsers? | Disable MathJax (What is MathJax?)