Seeing Is Not Screening: Multimodal Hidden Instruction Attacks on Agent Skill Scanners

2026-06-16

AI Summary

This study addresses a critical security gap in existing agent skill scanners, which rely solely on text, code, and manifests for safety analysis while overlooking malicious instructions concealed within images. Such oversight enables multimodal agents to execute harmful behaviors that bypass detection upon deployment. The work presents the first systematic characterization of this threat and introduces SkillCamo, an attack method that embeds malicious instructions into naturally referenced images within documentation. To counter this vulnerability, the authors propose ExecScan, a defense mechanism that integrates document content, code, resources, and visual elements to reconstruct execution intent and assess risk across multiple threat categories—including data exfiltration, destruction, persistence, deception, and privilege escalation. Experimental results demonstrate that current scanners fail to detect SkillCamo attacks, whereas ExecScan significantly enhances the security assessment capability for multimodal agent skills.

Abstract

Agent skills are emerging as an important attack surface in LLM-based systems. Through an empirical study of existing skill scanners, we find that current defenses primarily rely on textual descriptions, manifests, and source code as the main signals for security analysis, which can leave visually conveyed malicious intent insufficiently examined. This creates a practical blind spot: harmful operational instructions hidden in images may bypass scanning while still being recoverable by multimodal agents during deployment. To systematically investigate this threat, we propose SkillCamo, a document-mediated multimodal instruction attack that conceals malicious instructions within images bundled with a skill while rewriting the surrounding documentation to naturally reference those images as part of the normal workflow. Thus, the attack does not rely on the image alone, but on the joint interpretation of textual guidance and visual payload at execution time. To defend against such attacks, we further propose ExecScan, an execution-grounded multimodal scanning module that performs intent extraction, behavior reconstruction, abuse assessment, and deliberative execution simulation over skill artifacts. ExecScan jointly analyzes documentation, code, referenced resources, and visual content to recover hidden instructions, reconstruct executable behavior chains, and identify downstream risks such as exfiltration, destruction, persistence, deception, and privilege escalation. Extensive experiments show that image-hidden malicious instructions challenge existing skill scanners, while ExecScan can improve the skill scanning performance.

Problem

• multimodal attacks
• agent skill scanners
• hidden instructions
• image-based threats
• security blind spot

Innovation

• multimodal instruction attack
• skill scanner
• hidden malicious instruction
• execution-grounded analysis
• agent security