Search papers, labs, and topics across Lattice.
This paper introduces the concept of Skill Policy Integrity to address the risks posed by reusable agent skills in large language model (LLM) agents, which can covertly redirect decision-making towards undisclosed objectives. The authors present SkillShift, a black-box framework that enables covert policy steering while ensuring the integrity of the declared task and output interface. Their experiments demonstrate that SkillShift can achieve high attacker-favored selection rates in agentic commerce and software dependencies, all while preserving utility and evading detection by existing scanners.
Covert policy steering can achieve an 81.33% success rate in redirecting agent decisions without compromising output integrity or being detected.
Reusable agent skills extend large language model (LLM) agents with task procedures, tool-use guidance, and output constraints. Yet these skills also act as externalized behavioral policies, which create a supply-chain risk: a third-party skill may preserve the declared task and valid output interface while covertly redirecting agent decisions toward an undisclosed objective. We formalize Skill Policy Integrity, which requires a Skill-induced policy to remain aligned with its declared functionality and the user-authorized objective. We further present SkillShift, a constrained black-box framework for covert policy steering without explicit target command injection or task hijacking. It combines semantically plausible policy edits with hierarchical validation, failure-guided optimization, and strategy compression to preserve effectiveness, output validity, transferability, and inconspicuousness. We instantiate this threat in agentic commerce and software dependency use, with SkillShift achieving attacker-favored selection rates of 81.33% and 63.33% while maintaining a 100% utility-preserving rate. The frozen policies also transfer without further optimization across heterogeneous LLM backends and agent environments. Moreover, the evaluated scanners fail to detect the constructed skills, motivating behavioral auditing of reusable skills as agent policy artifacts.
