27 citations · 75 across the 23 of their papers we have counts for
7 papers · 1 filter
MalTotal: Cost-Effective and Language-Agnostic Malicious Code Poisoning Detection for Millions of Repositories
Jian Zhao, Shenao Wang, Qingyang Wu +3
The widespread adoption of open source software (OSS) has introduced significant security risks, with malicious code poisoning attacks increasingly targeting public package registr…
When Agents Do Not Stop: Uncovering Infinite Agentic Loops in LLM Agents
Xinyi Hou, Shenao Wang, Yanjie Zhao +1
LLM agents increasingly rely on iterative execution to solve tasks through planning, tool use, state updates, and agent collaboration. While this design enables flexible automation…
AgentFlow: Building Agent Dependency Graphs for Static Analysis of Agent Programs
Shenao Wang, Xinyi Hou, Yanjie Zhao +2
LLM agents are increasingly developed as source-code applications built on agent frameworks. These agent programs combine conventional host-language code with framework-defined sem…
Demystifying and Detecting Agentic Workflow Injection Vulnerabilities in GitHub Actions
Shenao Wang, Xinyi Hou, Zhao Liu +5
GitHub Actions is increasingly used to deploy LLM-based agents for repository-centric tasks such as issue triage, pull-request review, code modification, and release assistance. Th…
MalSkills: Detecting Malicious Skills in the Agentic Supply Chain via Neuro-symbolic Reasoning
Shenao Wang, Junjie He, Yanjie Zhao +3
Skills are increasingly used to extend LLM agents by packaging prompts, code, and configurations into reusable modules. As public registries and marketplaces expand, they form an e…
SMCP: Secure Model Context Protocol
Xinyi Hou, Shenao Wang, Yifan Zhang +4
Agentic AI systems built around large language models (LLMs) are moving away from closed, single-model frameworks and toward open ecosystems that connect a variety of agents, exter…
YASA: Scalable Multi-Language Taint Analysis on the Unified AST at Ant Group
Yayi Wang, Shenao Wang, Jian Zhao +7
Modern enterprises increasingly adopt diverse technology stacks with various programming languages, posing significant challenges for static application security testing (SAST). Ex…