正在加载页面…
Skill-augmented agents persist loaded skills across execution loops, creating severe vulnerabilities where malicious or compromised skills steer tool calls, leak secrets, or corrupt state after installation. Static pre-installation vetting cannot detect these task-conditioned threats. To address this challenge, the authors introduce Defense-as-Skill, deploying the runtime guard as an installable, inspectable, and editable skill named SkillSonar that dynamically gates sensitive actions through allow, replan, or confirmation decisions. They construct SCOPE-R, a benchmark spanning six risk families with 206 attack-confirmed malicious instances and 43 benign tasks, and optimize SkillSonar using feedback-driven Monte Carlo Tree Search. On repeated GLM-5 evaluations, SkillSonar substantially curtails attack success while preserving benign task utility across multiple agent harnesses.
This paper establishes that runtime safety defenses for autonomous coding agents can be natively packaged and iteratively evolved as agent skills themselves, rather than requiring intrusive host-runtime modifications, platform-level kernel sandboxing, or external moderation endpoints. By introducing the SCOPE-R taxonomy and closed-loop guard-skill evolution via MCTS, the work provides developers with modular, transparent, and portable defense primitives that achieve a favorable balance between risk mitigation and benign operational utility across diverse frontier foundation models.
论文中的结论可在「研究结论」中查看。