# SkillsBench

3 related articles

Subscribe to updates

arXiv Oct 1, 2026
APEX chains skills to carry a false user-approval record across handoffs, inducing attacker-selected actions in 74.2% of 690 SkillsBench attempts
The work introduces APEX, which builds and refines adversarial skill chains tailored to a user task and an attacker-selected action: an upstream skill induces the agent to write a record of genuine task progress, and a downstream skill uses that record to carry a false claim of user approval, inducing the selected action in 512 of 690 attempts (74.2%) across four targeted-action families and six models on SkillsBench, with 84.3% success on GPT-5.4 versus 17.4% when the workflow is merged into one skill; a prompting defense lowers GPT-5.4 targeted-action success from 84.3% to 59.1% while the verifier test-pass rate across 72 benign native-skill tasks falls from 86.7% to 56.3%.
The work introduces APEX, which builds and refines adversarial skill chains tailored to a user task and an attacker-selected action: an upstream skill induces the agent to write a record of genuine task progress, and a downstream skill uses that record to carry a false claim of user approval, inducing the selected action in 512 of 690 attempts (74.2%) across four targeted-action families and six models on SkillsBench, with 84.3% success on GPT-5.4 versus 17.4% when the workflow is merged into one skill; a prompting defense lowers GPT-5.4 targeted-action success from 84.3% to 59.1% while the verifier test-pass rate across 72 benign native-skill tasks falls from 86.7% to 56.3%.
Southeast University Shandong University Shanghai Jiao Tong University University of Hong Kong Southeast University
Tian Dong（First author）
APEX LLM Agents SkillsBench Skill-chain hijacking attack
arXiv Oct 1, 2026
SkillSeek matches an LLM-mediated retrieval loop on 89 SkillsBench tasks with BM25 plus a small reranker, cutting per-trial spend from USD 51.30 to USD 27.54
The work presents SkillSeek, an open-source two-stage skill retriever (a BGE-base bi-encoder feeding a small cross-encoder, exposed over MCP), and across a grid of two skill pools and two backbones on the 89-task SkillsBench benchmark observes that plain bm25 alone records a pass rate at or above Liu et al.'s LLM-mediated loop on three of four settings, with a small cross-encoder covering the remaining difference on the fourth (34K pool with Qwen3.5) at the same 0.442, while total per-trial spend drops from USD 51.30 to USD 27.54 (within fifty cents of the USD 27.41 no-skill baseline), a pattern the authors attribute to a first-stage recall ceiling.
The work presents SkillSeek, an open-source two-stage skill retriever (a BGE-base bi-encoder feeding a small cross-encoder, exposed over MCP), and across a grid of two skill pools and two backbones on the 89-task SkillsBench benchmark observes that plain bm25 alone records a pass rate at or above Liu et al.'s LLM-mediated loop on three of four settings, with a small cross-encoder covering the remaining difference on the fourth (34K pool with Qwen3.5) at the same 0.442, while total per-trial spend drops from USD 51.30 to USD 27.54 (within fifty cents of the USD 27.41 no-skill baseline), a pattern the authors attribute to a first-stage recall ceiling.
Stevens Institute of Technology
Guanqun Yang（First author）
SkillSeek Agent skill retrieval Two-stage retriever SkillsBench MCP server
arXiv Sep 29, 2026
SkillDRE evolves malicious agent skills through a dual-stage loop of pre-execution scanning and runtime feedback, reaching a 45.28% average attack success rate across four victim models on SkillsBench
SkillDRE is a fully automated framework that, given a benign task and its associated skills, autonomously constructs and validates a task-conditioned malicious objective and a verifiable judge rule, then holds both fixed while alternating scanner-guided evolution with runtime-defense-guided refinement, forming a closed loop between the pre-execution and runtime stages; on SkillsBench across four victim models it achieves an average attack success rate of 45.28%, exceeding the strongest baseline by 40.3%, while its final submitted skills receive no SkillScan findings and largely preserve benign-task performance.
SkillDRE is a fully automated framework that, given a benign task and its associated skills, autonomously constructs and validates a task-conditioned malicious objective and a verifiable judge rule, then holds both fixed while alternating scanner-guided evolution with runtime-defense-guided refinement, forming a closed loop between the pre-execution and runtime stages; on SkillsBench across four victim models it achieves an average attack success rate of 45.28%, exceeding the strongest baseline by 40.3%, while its final submitted skills receive no SkillScan findings and largely preserve benign-task performance.
Chongqing University of Posts and Telecommunications North China Electric Power University Beijing University of Posts and Telecommunications
Pengyu Zhu（First author）
SkillDRE Adaptive Red Teaming Agent Skills SkillsBench

You’re all caught up

APEX chains skills to carry a false user-approval record across handoffs, inducing attacker-selected actions in 74.2% of 690 SkillsBench attempts

SkillSeek matches an LLM-mediated retrieval loop on 89 SkillsBench tasks with BM25 plus a small reranker, cutting per-trial spend from USD 51.30 to USD 27.54

SkillDRE evolves malicious agent skills through a dual-stage loop of pre-execution scanning and runtime feedback, reaching a 45.28% average attack success rate across four victim models on SkillsBench