一句话：提出神经符号检测框架 MalSkills，从异构构件中推理识别 LLM 智能体供应链中的恶意技能，F1 达 93%。
技能（skill）把 prompt、代码与配置打包成可复用模块来扩展 LLM 智能体，随着公共注册表与市场扩张，它们构成了新兴的智能体供应链，也带来了恶意技能这一新攻击面。检测恶意技能的难点在于：关键证据分散在异构构件中，且必须结合上下文进行推理，而现有静态、基于 LLM 和动态的方法各自只覆盖问题的一部分。本文提出 MalSkills 神经符号框架：先结合符号解析与 LLM 辅助的语义分析，从异构构件中抽取安全敏感操作；再构建连接构件、操作、操作数与值流的技能依赖图；最后在该图上进行神经符号推理，推断恶意模式或此前未见过的可疑工作流。作者在含 200 个真实技能的基准上与 5 个 SOTA 基线对比，MalSkills 取得 93% F1，领先基线 5 至 87 个百分点；进一步分析 7 个公共注册表收集的 150,108 个技能，标记出 620 个潜在恶意技能，人工复核确认其中 400 个确为恶意，并已负责任地报告给平台与维护者。
Skills are increasingly used to extend LLM agents by packaging prompts, code, and configurations into reusable modules. As public registries and marketplaces expand, they form an emerging agentic supply chain, but also introduce a new attack surface for malicious skills. Detecting malicious skills is challenging because relevant evidence is often distributed across heterogeneous artifacts and must be reasoned in context. Existing static, LLM-based, and dynamic approaches each capture only part of this problem, making them insufficient for robust real-world detection. In this paper, we present MalSkills, a neuro-symbolic framework for malicious skills detection. MalSkills first extracts security-sensitive operations from heterogeneous artifacts through a combination of symbolic parsing and LLM-assisted semantic analysis. It then constructs the skill dependency graph that links artifacts, operations, operands, and value flows across the skill. On top of this graph, MalSkills performs neuro-symbolic reasoning to infer malicious patterns or previously unseen suspicious workflows. We evaluate MalSkills on a benchmark of 200 real-world skills against 5 state-of-the-art baselines. MalSkills achieves 93% F1, outperforming the baselines by 5-87 percentage points. We further apply MalSkills to analyze 150,108 skills collected from 7 public registries, flagging 620 potentially malicious skills. Through manual review, we confirm that 400 of them are indeed malicious, all of which were responsibly reported and are currently awaiting confirmation from the platforms and maintainers. These results demonstrate the practical potential of MalSkills in securing the agentic supply chain.
@inproceedings{paperbot12347,
title = {MalSkills: Detecting Malicious Skills in the Agentic Supply Chain via Neuro-symbolic Reasoning},
author = {Shenao Wang and Junjie He and Yanjie Zhao and Yayi Wang and Kan Yu and Haoyu Wang},
booktitle = {ASE},
year = {2026},
doi = {10.1145/3832783.3834375}
}