Search papers, labs, and topics across Lattice.
This study introduces OpenSkillRisk, a safety benchmark designed to evaluate how well LLM-based agents recognize and mitigate risks associated with third-party skills in open-world environments. By systematically analyzing 263 risky skills from public marketplaces, the authors classify these skills into seven threat categories and assess agent performance across three CLI frameworks and thirteen LLMs. Results reveal that no tested system reliably avoids risky actions, with a failure rate of approximately 17% even in the safest configurations, underscoring significant gaps in risk reasoning and execution control in current agent systems.
No current LLM-based agent can reliably avoid executing unsafe actions when using third-party skills, with a staggering 17% failure rate even in optimal conditions.
LLM-based agents leverage third-party skills to extend their capabilities in open-world scenarios. However, third-party skills can introduce extra security vulnerabilities, as seemingly harmless skills can contain latent safety risks that only emerge during actual execution. In this work, we conduct a systematic investigation into how well current agent systems recognize and avoid such risks. To support quantitative and qualitative evaluation, we construct OpenSkillRisk, a dedicated safety benchmark containing 263 risky skills collected from public skill marketplaces. We classify these skills into seven categories based on their threat types and pair each skill with a standardized user task and a corresponding sandbox for controlled evaluation. Distinct from prior benchmarks, OpenSkillRisk not only covers more realistic and diverse unsafe scenarios, but also provides a fine-grained analysis to diagnose the behavioral patterns of agents in such scenarios. We conduct comprehensive experiments covering three mainstream CLI agent frameworks and thirteen state-of-the-art LLMs. Experimental results show that no tested system handles risky skills reliably: even the safest configurations still execute unsafe actions in about 17% of cases. Context-dependent and system-level risks are especially difficult for current agent systems to avoid. Our behavioral analysis reveals three recurring failure patterns: agents may fail to recognize the risk, recognize it but fail to intervene before acting, or follow skill instructions beyond the user's intended scope. These findings highlight the need to improve both risk reasoning in LLMs and execution control in agent frameworks.
