Seeing Is Not Screening: Multimodal Hidden Instruction Attacks on Agent Skill Scanners

• URL: http://arxiv.org/abs/2606.18198v1
• Date: Tue, 16 Jun 2026 17:29:11 GMT
• Title: Seeing Is Not Screening: Multimodal Hidden Instruction Attacks on Agent Skill Scanners
• Abstract summary: Agent skills are emerging as an important attack surface in LLM-based systems.<n>Current defenses rely on textual descriptions, manifests, and source code as the main signals for security analysis.<n>We propose SkillCamo, a document-mediated multimodal instruction attack that conceals malicious instructions within images bundled with a skill.<n>We also propose ExecScan, an execution-grounded multimodal scanning module that performs intent extraction, behavior reconstruction, abuse assessment, and deliberative execution simulation.
• Score: 34.485920220166285
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Agent skills are emerging as an important attack surface in LLM-based systems. Through an empirical study of existing skill scanners, we find that current defenses primarily rely on textual descriptions, manifests, and source code as the main signals for security analysis, which can leave visually conveyed malicious intent insufficiently examined. This creates a practical blind spot: harmful operational instructions hidden in images may bypass scanning while still being recoverable by multimodal agents during deployment. To systematically investigate this threat, we propose SkillCamo, a document-mediated multimodal instruction attack that conceals malicious instructions within images bundled with a skill while rewriting the surrounding documentation to naturally reference those images as part of the normal workflow. Thus, the attack does not rely on the image alone, but on the joint interpretation of textual guidance and visual payload at execution time. To defend against such attacks, we further propose ExecScan, an execution-grounded multimodal scanning module that performs intent extraction, behavior reconstruction, abuse assessment, and deliberative execution simulation over skill artifacts. ExecScan jointly analyzes documentation, code, referenced resources, and visual content to recover hidden instructions, reconstruct executable behavior chains, and identify downstream risks such as exfiltration, destruction, persistence, deception, and privilege escalation. Extensive experiments show that image-hidden malicious instructions challenge existing skill scanners, while ExecScan can improve the skill scanning performance.

Related papers

• Cloak and Detonate: Scanner Evasion and Dynamic Detection of Agent Skill Malware [15.064889350201511]
  Malicious skills can steal credentials, exfiltrate source code, or install backdoors.<n> Existing defenses use pattern matching or LLM-as-judge analysis.<n>We propose SkillDetonate, a behavior-centric auditor that executes skills in a sandbox.
  arXiv  Detail & Related papers  (2026-07-02T16:00:52Z)
• DE-FIVE: Detecting Malicious Image Prompts via Fourier Features and Image Vector Embeddings [0.870967746482596]
  We introduce DE-FIVE, a training-free framework for detecting malicious image prompts.<n>We develop a hybrid detection strategy consisting of a black-box detector and a white-box detector.<n>Extensive experiments demonstrate that the proposed framework consistently outperforms state-of-the-art baselines against malicious image prompts.
  arXiv  Detail & Related papers  (2026-06-22T02:42:38Z)
• PhantomSkill: Malicious Code Injection in Agent Skill Ecosystems [8.017582494003564]
  PhantomSkill is an attack framework that hides malicious behavior in a skill's auxiliary resources.<n>VulMask rewrites overt malicious scripts into vulnerability-shaped implementations whose malicious behavior is activated only under attacker-controlled trigger conditions.<n>Our results show that skill ecosystems require resource-level vetting, execution-time containment, and security policies that treat exploitable vulnerabilities in agent skills as potential malicious payloads.
  arXiv  Detail & Related papers  (2026-06-17T15:33:41Z)
• Red-Teaming Agent Execution Contexts: Open-World Security Evaluation on OpenClaw [9.193028511327851]
  This paper presents DeepTrap, an automated framework for discovering contextual vulnerabilities in OpenClaw.<n>DeepTrap balances risk realization, benign-task preservation, and stealth.<n>Results show that contextual compromise can induce substantial unsafe behavior while preserving user-facing task completion.
  arXiv  Detail & Related papers  (2026-05-11T13:20:02Z)
• Trust Me, Import This: Dependency Steering Attacks via Malicious Agent Skills [25.627983175254958]
  We introduce Dependency Steering, an attack paradigm in which a malicious Skill biases a coding agent toward an attacker-controlled package.<n>Our results show that persistent agent instructions form an underexplored software supply chain attack surface.
  arXiv  Detail & Related papers  (2026-05-10T15:13:38Z)
• SkillJect: Automating Stealthy Skill-Based Prompt Injection for Coding Agents with Trace-Driven Closed-Loop Refinement [120.52289344734415]
  We propose an automated framework for stealthy prompt injection tailored to agent skills.<n>The framework forms a closed loop with three agents: an Attack Agent that synthesizes injection skills under explicit stealth constraints, a Code Agent that executes tasks using the injected skills and an Evaluate Agent that logs action traces.<n>Our method consistently achieves high attack success rates under realistic settings.
  arXiv  Detail & Related papers  (2026-02-15T16:09:48Z)
• Cuckoo Attack: Stealthy and Persistent Attacks Against AI-IDE [64.47951172662745]
  Cuckoo Attack is a novel attack that achieves stealthy and persistent command execution by embedding malicious payloads into configuration files.<n>We formalize our attack paradigm into two stages, including initial infection and persistence.<n>We contribute seven actionable checkpoints for vendors to evaluate their product security.
  arXiv  Detail & Related papers  (2025-09-19T04:10:52Z)
• ForensicsSAM: Toward Robust and Unified Image Forgery Detection and Localization Resisting to Adversarial Attack [56.0056378072843]
  We show that highly transferable adversarial images can be crafted solely via the upstream model.<n>We propose ForensicsSAM, a unified IFDL framework with built-in adversarial robustness.
  arXiv  Detail & Related papers  (2025-08-10T16:03:44Z)
• Manipulating Multimodal Agents via Cross-Modal Prompt Injection [34.35145839873915]
  We identify a critical yet previously overlooked security vulnerability in multimodal agents.<n>We propose CrossInject, a novel attack framework in which attackers embed adversarial perturbations across multiple modalities.<n>Our method outperforms state-of-the-art attacks, achieving at least a +30.1% increase in attack success rates.
  arXiv  Detail & Related papers  (2025-04-19T16:28:03Z)
• Document Screenshot Retrievers are Vulnerable to Pixel Poisoning Attacks [72.4498910775871]
  Vision-language model (VLM)-based retrievers leverage document screenshots embedded as vectors to enable effective search and offer a simplified pipeline over traditional text-only methods.<n>In this study, we propose three pixel poisoning attack methods designed to compromise VLM-based retrievers.
  arXiv  Detail & Related papers  (2025-01-28T12:40:37Z)
• Hiding Local Manipulations on SAR Images: a Counter-Forensic Attack [17.78894837783128]
  The vast accessibility of Synthetic Aperture Radar (SAR) images through online portals has propelled the research across various fields.<n>Vulnerability is further emphasized by the fact that most SAR products are often released as amplitude-only information.<n>In this paper we demonstrate that an expert practitioner can exploit the complex nature of SAR data to obscure any signs of manipulation.
  arXiv  Detail & Related papers  (2024-07-09T17:03:57Z)
• Adversarial EXEmples: A Survey and Experimental Evaluation of Practical Attacks on Machine Learning for Windows Malware Detection [67.53296659361598]
  adversarial EXEmples can bypass machine learning-based detection by perturbing relatively few input bytes. We develop a unifying framework that does not only encompass and generalize previous attacks against machine-learning models, but also includes three novel attacks. These attacks, named Full DOS, Extend and Shift, inject the adversarial payload by respectively manipulating the DOS header, extending it, and shifting the content of the first section.
  arXiv  Detail & Related papers  (2020-08-17T07:16:57Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.