Search papers, labs, and topics across Lattice.
This paper critiques the current reliance on self-evolving skills in AI agents, highlighting the risks associated with "Borrowed Authority," where malicious skills can exploit agent permissions to cause physical harm. The authors propose a novel solution, Edge Skillguard, which integrates a typed authority layer within the Skill artifact to prevent unauthorized actions while allowing legitimate requests. Experimental results demonstrate that Edge Skillguard effectively rejects all malicious authority requests without impeding benign operations, even under scaled conditions.
Malicious skills can exploit agent permissions to cause physical harm, but a new authority layer could prevent this without hindering legitimate actions.
Self-evolving Skill harnesses (AutoSkills, Hermes Agent) generate more advisory orchestration automatically; their reported gains are efficiency, not safety. This misses the actual gap: a Skill describes how an agent should behave; a Policy decides which behavior is allowed to become an action. Today's format covers the first with markdown and scripts; the second is left to the model. Generating more Skills scales the gap, not the safety, especially when a wrong invocation can unlock a door or move money. Two adjacent attacks are documented: malicious skills compromising cloud software, and jailbroken LLM-controlled robots causing physical harm. Their intersection, malicious agent skills causing physical harm, follows directly but has not been reported. We name this class Borrowed Authority: Skills format gives the receiving agent no typed way to reject an inter-agent permission claim, so a malicious or misused Skill can drive actuation by attaching one. We propose Edge Skillguard, a typed authority layer that lives inside the Skill artifact rather than between tools as workflow engines do, with guards over world state and sensor evidence. On a live edge control-plane testbed, the guards reject 60/60 borrowed-authority requests across five attack variants without blocking benign requests, and the result holds at 5x scale and across hosts over a Tailscale mesh. These results suggest that high-risk Skills should co-package typed invocation policy with procedural knowledge, so that physical actions depend on machine-checkable evidence rather than peer-agent claims.
