A Finger on the Scale: Covert Policy Steering through Agentic Skills

2026-09-02

AI Summary

本文针对第三方技能可能隐秘改变大语言模型代理决策的问题，提出SkillShift框架，通过语义编辑和多层验证等方法实现隐蔽的策略导向。

Abstract

Reusable agent skills extend large language model (LLM) agents with task procedures, tool-use guidance, and output constraints. Yet these skills also act as externalized behavioral policies, which create a supply-chain risk: a third-party skill may preserve the declared task and valid output interface while covertly redirecting agent decisions toward an undisclosed objective. We formalize Skill Policy Integrity, which requires a Skill-induced policy to remain aligned with its declared functionality and the user-authorized objective. We further present SkillShift, a constrained black-box framework for covert policy steering without explicit target command injection or task hijacking. It combines semantically plausible policy edits with hierarchical validation, failure-guided optimization, and strategy compression to preserve effectiveness, output validity, transferability, and inconspicuousness. We instantiate this threat in agentic commerce and software dependency use, with SkillShift achieving attacker-favored selection rates of 81.33% and 63.33% while maintaining a 100% utility-preserving rate. The frozen policies also transfer without further optimization across heterogeneous LLM backends and agent environments. Moreover, the evaluated scanners fail to detect the constructed skills, motivating behavioral auditing of reusable skills as agent policy artifacts.

Problem

• Skill Policy Integrity
• covert policy steering
• large language model (LLM) agents
• reusable agent skills
• security risk

Innovation

• Skill Policy Integrity
• SkillShift
• covert policy steering
• hierarchical validation
• failure-guided optimization