OpenSkillRisk: Benchmarking Agent Safety When Using Real-World Risky Third-Party Skills

2026-07-22 · Source: Computation and Language · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy, Robotics & Autonomous Systems · Depth: Expert, quick

Summary

OpenSkillRisk is a new safety benchmark designed to systematically investigate how well LLM-based agent systems recognize and avoid latent safety risks introduced by real-world third-party skills. The benchmark features 263 risky skills collected from public marketplaces, classified into seven threat categories, each with a standardized user task and a corresponding sandbox for controlled evaluation. Comprehensive experiments covering three mainstream CLI agent frameworks and thirteen state-of-the-art LLMs demonstrate that no tested system reliably handles these risks; even the safest configurations execute unsafe actions in about 17% of cases. The study identifies context-dependent and system-level risks as particularly challenging for current agents, revealing recurring failure patterns where agents fail to recognize risk, recognize but do not intervene, or follow instructions beyond the user's intended scope.

Key takeaway

For AI Security Engineers deploying LLM-based agents, this research indicates that current systems cannot reliably mitigate risks from third-party skills. You must implement robust, external validation and intervention mechanisms beyond the agent's inherent reasoning. Prioritize developing custom safeguards for context-dependent and system-level risks, as agents frequently fail to recognize or prevent unsafe actions, even in controlled environments. Your security posture should assume inherent risk with third-party skill integration.

Key insights

LLM agents using third-party skills face significant, unmitigated safety risks from latent vulnerabilities.

Principles

• Third-party skills introduce latent safety risks.
• Agent systems struggle with context-dependent and system-level risks.
• Improved risk reasoning and execution control are needed.

Method

OpenSkillRisk constructs a safety benchmark of 263 categorized risky skills, each with a user task and sandbox for controlled evaluation of agent behavior.

In practice

• Agents may fail to recognize or intervene on risks.
• Agents can over-execute skill instructions.

Topics

• LLM Agents
• Third-Party Skills
• Agent Safety
• Security Benchmarking
• Risk Assessment
• Execution Control

Best for: CTO, VP of Engineering/Data, Director of AI/ML, AI Scientist, AI Security Engineer, AI Engineer

Related on AIssential

• OpenSkillRisk: Benchmarking Agent Safety When Using Real-World Risky Third-Party Skills — LLM agents struggle to reliably identify and avoid risks from third-party skills, even with safety configurations.
• OpenSkillRisk: Benchmarking Agent Safety When Using Real-World Risky Third-Party Skills — LLM-based agents exhibit significant safety vulnerabilities when using third-party skills, failing to avoid unsafe actions in 17% of cases.
• SafeClawBench: Separating Semantic, Audit-Evidence, and Sandbox Harm in Tool-Using LLM Agents — Tool-using LLM agent security requires distinguishing semantic compliance from observable, executable harm.
• SLBench: Evaluating How LLM Agents Follow Logical Relations in Skills — LLM agents struggle with logical relations in skill files, leading to unsafe outcomes despite task completion.
• SkillsBench: Benchmarking How Well Agent Skills Work Across Diverse Tasks — Agent Skills significantly boost LLM performance, but effectiveness varies, and self-generation is currently ineffective.
• Beyond Function Calling: Benchmarking Tool-Using Agents under Tool-Environment Unreliability — LLM agents struggle with tool unreliability, requiring better hazard diagnosis and recovery for real-world task completion.

See Counsel's argued verdicts on the open AI decisions leaders are weighing →

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by Computation and Language.