Skills leave artifacts across sessions, and attackers use them: up to 77.4% of runs fell, a runtime guard cut that to 10.9%

Cross-session cooperation between skill packages is itself an attack channel: an upstream skill writes attack content into persistent artifacts during a legitimate task, and a downstream skill guides the agent to read and use that content in a later session, so malicious influence survives even after conversation history is reset. Earlier skill-security evaluations mostly examined vulnerabilities, malicious behavior and credential leakage inside individual skill packages, or audited and detected malicious skills, without adequately examining how multiple attacker-controlled skills coordinate across independent sessions through persistent task artifacts. SkillRelayBench contains 270 adversarial cases drawn from 30 two-stage task scenarios across ten business domains; each case retains task artifacts and resets conversation history between sessions, separately judging legitimate task completion, occurrence of the target security consequence, and whether the attack chain was realized.

The evaluation shows these attacks are broadly feasible on current agents, and that completing the user's task does not indicate safe execution. Across seven model configurations, attack success rates range from 46.7% to 77.4% and attack chain success rates from 35.6% to 61.1%; of all 1,890 runs, 1,001 (53.0%) achieved both the user's task and the attack objective. Evaluation covers three agent frameworks, Codex CLI, Gemini CLI and Claude Code, with each configuration run on all 270 adversarial cases and independent Task and Attack Judges deciding from execution traces, workspace snapshots, simulated service records and original task materials.

The runtime defense SkillRelayGuard restores an artifact's provenance associations and usage boundary when it is read, and an independent reviewer supplies evidence and revision advice before an operation executes, while the final decision stays with the task-execution agent. Without the defense, overall attack success was 69.5%, attack chain success 54.8% and task success 79.6%; with it, those become 10.9%, 10.0% and 87.5%, a 58.6 percentage point drop in attack success and a 7.9 point rise in task completion. Compared on 270 adversarial cases for one configuration each of Codex CLI, Gemini CLI and Claude Code; the ablation shows attack success of 73.3% with context restoration alone, 25.9% with pre-execution review alone, and 17.4% with both enabled.

The evaluation covers 30 two-stage task scenarios across ten business domains and 270 adversarial cases, with artifacts spanning ten primary formats including databases, structured files, editable documents and textual notes, and five target security consequence categories: unauthorized disclosure, unauthorized operation, status integrity violation, output integrity violation and software integrity violation. The defense is evaluated on one configuration each of Codex CLI, Gemini CLI and Claude Code, and the ablation study uses only Codex CLI. It suits readers following agent skill ecosystems, runtime defenses and tool-call authorization.

The authors note that Agent-as-Judge may misinterpret borderline cases; agent execution is stochastic, so individual outcomes may vary with sampling and execution paths, and cross-configuration evidence does not replace repeated runs within the same configuration; the ablation study uses only Codex CLI, leaving the generalizability of component contributions to other configurations to be validated; and the benchmark cannot exhaustively cover real-world scenarios, so generalization to other workflows requires further validation. Residual risk remains in the defense itself: it enforces context delivery and review, but the final content-level decision stays with the agent, which may disregard restored context or confirm a request despite review advice.