Research map / Multi-agent systems and games / LLM agents

Seeing Is Not Screening: Multimodal Hidden Instruction Attacks on Agent Skill Scanners

NeurIPS 2026 · Multi-agent systems and games › LLM agents · approach: Agent safety and attack benchmarks · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes SkillCamo, a scanner-in-the-loop attack that hides malicious shell commands in images bundled with agent skills and rewrites SKILL.md to reference them, plus ExecScan, an execution-grounded multimodal skill scanner that recovers hidden instructions and simulates execution.

Problem

Existing agent skill scanners inspect mainly text, manifests, and code, so malicious operational instructions hidden in bundled images can evade detection yet be recovered by multimodal agents at execution time.

Approach

Conceal malicious commands in skill-bundled images (full, split, or cloze variants) while LLM-rewriting the documentation to naturally reference them, iteratively refined with scanner feedback; defend with a multi-stage scanner that jointly analyzes text, code, and images and simulates execution contexts to score risk.

Key results

• SkillCamo achieves 78-100% ASR against six baseline scanners (e.g., 100% on Cisco, 87% on HSS).
• ExecScan reduces ASR on SkillCamo to 8% and achieves F1 83.8%, Recall 82.0%, FPR 27.4% on the defense benchmark.
• Adding explicit image-warning prompts reduces ASR for Vetter by 70 points but increases HSS ASR by 8 points.

Surprising findings

• Explicit image-warning prompts can backfire, increasing HSS ASR by 8 points.
• Cisco scanner is entirely unaffected by image-warning prompts because its pipeline does not rely on LLM image reasoning.

Limitations

• Bounded set of skill sources, attack variants, instruction templates, scanners, and backbone LLMs.
• ExecScan increases scanner cost due to multimodal analysis and execution simulation.
• Focuses on pre-deployment screening; does not replace runtime sandboxing or monitoring.

Experimental setup

Datasets: ClawHub skills skill0.io skills GitHub skills official repository skills

Benchmarks: SkillCamo adversarial skill set (400 skills) benign evaluation set (200 skills)

Metrics: ASR FPR Precision Recall F1

Baselines: Cisco Skill Scanner HSS-Scan ClawGuard Auditor SlowMist Skill Vetter SkillFortify SkillJect

Builds on: SkillJect

Closest papers by meaning

• Skill-Inject: Measuring Agent Vulnerability to Skill File Attacks (NeurIPS 2026 · similarity 0.88)
• Stealth Apart, Harm Together: Skill Cascading Attacks on Skill-Based Agent Systems (NeurIPS 2026 · similarity 0.86)
• Defense-as-Skill: Evolving Runtime Guard Skill for Skill-Augmented Agents (NeurIPS 2026 · similarity 0.85)
• XFeat Revisited: Reproducibility and Evaluation of a Lightweight Image Matcher (NeurIPS 2026 · similarity 0.85)
• [Re] Boosting the Visual Interpretability of CLIP via Adversarial Fine-Tuning (NeurIPS 2026 · similarity 0.85)
• Think Twice Before You Act: Protecting LLM Agents Against Tool Description Poisoning via Isolated Planning (ICML 2026 · similarity 0.85)