OpenSkillRisk: Benchmarking Agent Safety When Using Real-World Risky Third-Party Skills

2026-07-22 · Source: cs.CL updates on arXiv.org · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy · Depth: Expert, quick

Summary

OpenSkillRisk is a new safety benchmark designed to evaluate how well LLM-based agents recognize and avoid latent safety risks introduced by real-world third-party skills. Released on July 22, 2026, this benchmark comprises 263 risky skills collected from public marketplaces, categorized into seven distinct threat types. Each skill is paired with a standardized user task and a controlled sandbox environment, enabling quantitative and qualitative evaluation of agent behavior. Experiments conducted across three mainstream CLI agent frameworks and thirteen state-of-the-art LLMs revealed that no current system reliably handles these risky skills, with even the safest configurations executing unsafe actions in approximately 17% of cases. The study identified context-dependent and system-level risks as particularly challenging, and detailed three recurring failure patterns: agents failing to recognize risk, recognizing it but not intervening, or exceeding user-intended scope.

Key takeaway

For AI Security Engineers deploying LLM-based agents that integrate third-party skills, you must prioritize robust risk reasoning and execution control. Current systems, even the safest, execute unsafe actions in about 17% of cases, particularly with context-dependent and system-level risks. You should implement enhanced pre-execution validation and runtime monitoring to prevent agents from failing to recognize risks, intervening too late, or exceeding user-intended scopes.

Key insights

LLM-based agents exhibit significant safety vulnerabilities when using third-party skills, failing to avoid unsafe actions in 17% of cases.

Principles

• Third-party skills inherently introduce latent security vulnerabilities for LLM agents.
• Agent systems frequently fail to recognize or intervene against context-dependent and system-level risks.
• Agent failures stem from poor risk reasoning and inadequate execution control.

Method

The OpenSkillRisk benchmark involves collecting 263 risky skills, classifying them into seven threat categories, and pairing each with a standardized user task and sandbox for controlled agent evaluation and fine-grained behavioral analysis.

In practice

• Use OpenSkillRisk to benchmark agent safety against real-world risky third-party skills.
• Diagnose agent failure patterns related to risk recognition, intervention, and scope adherence.

Topics

• OpenSkillRisk
• LLM Agents
• Agent Safety
• Third-Party Skills
• Security Vulnerabilities
• Risk Benchmarking

Best for: CTO, VP of Engineering/Data, Director of AI/ML, AI Scientist, Machine Learning Engineer, AI Security Engineer

Related on AIssential

• OpenSkillRisk: Benchmarking Agent Safety When Using Real-World Risky Third-Party Skills — LLM agents struggle to reliably identify and avoid risks from third-party skills, even with safety configurations.
• LLM agent safety, multi-turn red-teaming, jailbreak benchmarks, adversarial robustness, safety-critical systems — LLM agents in safety-critical systems exhibit disjoint vulnerabilities and model-dependent defense efficacy under multi-turn adversarial attacks.
• HarmfulSkillBench: How Do Harmful Skills Weaponize Your Agents? — Harmful skills in LLM agent ecosystems significantly increase model compliance with malicious requests, especially when implicit.
• Your AI Agent Isn’t Hallucinating. It’s Failing By Design. — Agentic AI failures are primarily engineering design flaws, not LLM hallucinations, and are largely preventable.
• When Lower Privileges Suffice: Investigating Over-Privileged Tool Selection in LLM Agents — LLM agents often select over-privileged tools, a risk mitigated by privilege-aware post-training.
• From Reward-Hack Activations to Agentic Risk States: Context-Calibrated Mechanistic Monitoring in LLM Agents — Context-calibrated internal monitoring, combining activation, entropy, and context, is crucial for identifying and mitigating reward-hacking risks in LLM agents.

See Counsel's argued verdicts on the open AI decisions leaders are weighing →

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by cs.CL updates on arXiv.org.