5 papers
How Your Credentials Are Leaked by LLM Agent Skills: An Empirical Study
Zhihao Chen, Ying Zhang, Yi Liu +7
Large Language Model (LLM) agents increasingly rely on third-party skills that operate within privileged execution environments and routinely handle sensitive credentials, yet how…
SNARE: Adaptive Scenario Synthesis for Eliciting Overeager Behavior in Coding Agents
Yubin Qu, Yi Liu, Gelei Deng +4
A coding agent executes a benign task as a sequence of shell, file, and network actions, any of which can quietly exceed the authorized scope while the task still completes. We cal…
MIRAGE: Context-Aware Prompt Injection against Mobile GUI Agents via User-Generated Content
Ruoqi Guo, Yi Liu, Gelei Deng +7
Mobile graphical user interface (GUI) agents driven by vision-language models (VLMs) perceive the screen as rendered pixels and choose actions from what they see, so they cannot re…
Supply-Chain Poisoning Attacks Against LLM Coding Agent Skill Ecosystems
Yubin Qu, Yi Liu, Tongcheng Geng +5
LLM-based coding agents extend their capabilities via third-party agent skills distributed through open marketplaces without mandatory security review. Unlike traditional packages,…
CognixShield: PoV-Guided Vulnerable API Usage Detection in Large Codebases via LLMs
Wang Lingxiang, Quanzhi Fu, Wenjia Song +4
The integration of open-source libraries in Java development introduces severe security risks through vulnerable APIs. Existing program analysis and deep learning tools face the ch…