OpenSkillRisk: Benchmarking Agent Safety When Using Real-World Risky Third-Party Skills

2026-07-22 · Source: Takara TLDR - Daily AI Papers · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy, Robotics & Autonomous Systems · Depth: Expert, quick

Summary

OpenSkillRisk is a dedicated safety benchmark designed to systematically investigate how well current LLM-based agent systems recognize and avoid risks introduced by real-world third-party skills. The benchmark comprises 263 risky skills collected from public marketplaces, classified into seven threat categories, each paired with a standardized user task and a controlled sandbox environment. Distinct from prior benchmarks, OpenSkillRisk offers more realistic and diverse unsafe scenarios and provides fine-grained analysis of agent behavior. Comprehensive experiments across three mainstream CLI agent frameworks and thirteen LLMs revealed that no tested system handles risky skills reliably; even the safest configurations execute unsafe actions in approximately 17% of cases. Context-dependent and system-level risks proved particularly challenging, with agents failing to recognize risks, recognizing them but failing to intervene, or exceeding user-intended scope.

Key takeaway

For AI Security Engineers evaluating LLM-based agents that use third-party skills, you must assume inherent safety vulnerabilities. Current systems execute unsafe actions in about 17% of cases, especially with context-dependent risks. Prioritize improving risk reasoning in your LLMs and enhancing execution control within agent frameworks to mitigate these persistent failure patterns and prevent agents from exceeding user-intended scopes.

Key insights

LLM agents struggle to reliably identify and avoid risks from third-party skills, even with safety configurations.

Principles

• Third-party skills introduce latent safety risks to LLM agents.
• Current agent systems fail to reliably handle risky skills.
• Context-dependent risks are particularly challenging for agents.

Method

OpenSkillRisk constructs a safety benchmark with 263 risky skills, categorized by threat type, paired with standardized tasks and sandboxes for controlled evaluation and fine-grained behavioral analysis.

In practice

• Benchmark agent systems against 263 real-world risky skills.
• Diagnose agent failure patterns: risk recognition, intervention, scope adherence.

Topics

• LLM Agents
• Agent Safety
• Third-Party Skills
• Benchmarking
• OpenSkillRisk
• Security Vulnerabilities

Best for: Research Scientist, CTO, VP of Engineering/Data, AI Scientist, AI Security Engineer, AI Engineer

Related on AIssential

• OpenSkillRisk: Benchmarking Agent Safety When Using Real-World Risky Third-Party Skills — LLM agents using third-party skills face significant, unmitigated safety risks from latent vulnerabilities.
• SafeClawBench: Separating Semantic, Audit-Evidence, and Sandbox Harm in Tool-Using LLM Agents — Tool-using LLM agent security requires distinguishing semantic compliance from observable, executable harm.
• From Reward-Hack Activations to Agentic Risk States: Context-Calibrated Mechanistic Monitoring in LLM Agents — Context-calibrated internal monitoring, combining activation, entropy, and context, is crucial for detecting risky LLM agent actions.
• The AI Agent Security Surface: What Gets Exposed When You Add Tools and Memory — AI agents introduce four distinct attack surfaces requiring a new security paradigm beyond traditional LLM prompt defenses.
• Beyond Function Calling: Benchmarking Tool-Using Agents under Tool-Environment Unreliability — LLM agents struggle with tool unreliability, requiring better hazard diagnosis and recovery for real-world task completion.
• SLBench: Evaluating How LLM Agents Follow Logical Relations in Skills — LLM agents struggle with logical relations in skill files, leading to unsafe outcomes despite task completion.

See Counsel's argued verdicts on the open AI decisions leaders are weighing →

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by Takara TLDR - Daily AI Papers.