一句话：首次大规模实证研究 LLM agent 技能的凭证泄露，归纳出 10 类泄露模式，并揭示 fork 分发使修复失效。
论文首次大规模实证研究 LLM agent 第三方技能的凭证泄露。作者从开源技能市场 SkillsMP 的 170,226 个制品中分层抽样 17,022 个技能，用静态密钥提取（正则与 AST 解析）、注入 mock 凭证的动态沙箱测试及开发者意图比对，发现 520 个受影响技能、1,708 个安全问题，归纳出 10 类泄露模式。关键结果：76.3% 的案例需联合分析自然语言描述与程序逻辑，表明凭证暴露是跨模态的；Information Exposure 占 73.5%，因 agent 框架把 stdout 注入 LLM 上下文；89.6% 的泄露凭证可立即利用，fork 分发更使修复失效。恶意技能已移除，数据集与流水线开源。
Large Language Model (LLM) agents increasingly rely on third-party skills that operate within privileged execution environments and routinely handle sensitive credentials, yet how these credentials are leaked remains largely unexplored. To fill this gap, we present the first large-scale empirical study on credential leakage in agent skills. From 170,226 artifacts on SkillsMP, the largest open-source skill marketplace, we sampled 17,022 skills via stratified random sampling and analyzed each through static secret extraction (regex and AST parsing), dynamic sandbox testing of flagged candidates seeded with mock credentials, and cross-referencing developer intent against runtime behavior. Our analysis identifies 520 affected skills containing 1,708 security issues, and yields a taxonomy of 10 leakage patterns. Three findings stand out. First, 76.3% of cases require jointly analyzing natural-language descriptions and programming logic, showing that credential exposure in skills is fundamentally cross-modal. Second, Information Exposure accounts for 73.5% of vulnerability issues because agent frameworks feed stdout into the LLM context window, turning routine debugging into a credential exposure vector. Third, 89.6% of leaked credentials are immediately exploitable, and the fork-based distribution model defeats remediation, as secrets removed from upstream repositories persist across 50+ independent forks. Following responsible disclosure, all malicious skills have been removed. We release our dataset, taxonomy, and detection pipeline to support future agent security research.
@inproceedings{paperbot12240,
title = {How Your Credentials Are Leaked by LLM Agent Skills: An Empirical Study},
author = {Zhihao Chen and Ying Zhang and Yi Liu and Gelei Deng and Yuekang Li and Yanjun Zhang and Jianting Ning and Leo Yu Zhang and Lei Ma and Zhiqiang Li},
booktitle = {ASE},
year = {2026},
doi = {10.1145/3832783.3834373}
}