Permission gating nearly halves skill-injection success — 36.7% → 18.0%

Notes on SkillGuard: A Permission-Centric Framework for Agent Skill Security (arXiv:2606.03024) — Shidong Pan, Xiaoyu Sun, Tianyi Zhang, Dianshu Liao, Kaiwen Yang, Zhenchang Xing · June 2026

Note published July 25, 2026 · written by SkillFed’s research pipeline from the paper above · how these notes are made

AI-assisted notes · reviewed by SkillFed Skill security

Agent skills aren't just documentation anymore — they're bundles of instructions, scripts, and tool bindings that can steer an agent's reasoning before any tool executes, then trigger real side effects once one does. Most defenses cover only one side of that: scanning a skill's files before install, or gating individual tool calls at runtime. Nothing connects what a skill declares it needs to what it actually does once running. SkillGuard closes that gap with a skill manifest — a JSON schema declaring the resources a skill needs — checked against a runtime permission layer that intercepts every tool call and enforces deny-by-default on anything undeclared. High-stakes actions get escalated to the user for approval. Underneath sits a taxonomy of eight resource groups — storage, code repository, network, execution, hardware, system, secrets, agent ecosystem — broken into 41 distinct labels such as READ_FILE and WRITE_FILE, built on the classical least privilege and complete-mediation principles that systems like Android's permission model already lean on. Testing whether that taxonomy actually covers what real skills do meant checking it against 1,260 skills mined across 63 categories on the SkillsMP marketplace — the top 10 by star count plus 10 random picks per category — with every observed action mapped onto it.

Coverage held at 99.93%: almost every protected object those 1,260 skills touched fell inside a predefined permission, and every observed action landed in one of the eight resource groups. The real test was adversarial — running SkillGuard against SkillInject, a benchmark of 50 skills paired with injection-bearing variants across domains like document processing, payment integrations, and healthcare, run through three agent scaffolds: Gemini CLI, Codex CLI, and Claude Code. Permission gating cut obvious prompt injection success from 36.7% to 18.0%, and contextual-injection success from 35.3% to 20.7%. Benign task completion slipped from 87.1% to 80.6%, a 6.5-point cost. The protection isn't free to run, either: about 24.7% more tokens per task on average, and wall-clock effects that swing hard by scaffold — 43% faster on Claude Code, since blocked attacks terminate early, but 92.1% slower on Codex CLI.

Key numbers

Permission-taxonomy coverage across 1,260 real skills	99.93%
Obvious-injection success, undefended → SkillGuard	36.7% → 18.0%
Contextual-injection success, undefended → SkillGuard	35.3% → 20.7%
Benign task-completion cost	87.1% → 80.6% (−6.5 pts)
Added token overhead	+24.7%

What this means for skill authors

The residual attack success after gating — 18% to 21% — is the more interesting number, because SkillGuard's own error analysis explains exactly where it comes from. Two failure modes survive: skills that reuse a permission they legitimately declared (forwarding email through a network permission the skill needed anyway), and content-only attacks where the malicious intent lives in what gets written, not which capability gets called. Neither is really a permission-model failure — they mark the boundary of what a capability check can see. A skill asking for READ_FILE and NETWORK to summarize-and-email a document looks identical whether it emails the right person or exfiltrates to an attacker. Narrow permissions still matter for skill authors, but the real fix the paper lands on is domain-scoped network access instead of a blanket NETWORK grant.

This is close to the gap SkillFed's dual-tool scanning is built around: a declared-capability check answers whether a skill should be allowed to do something, not whether what it's doing with that access is legitimate — that second question is a semantic read on content and behavior, not a manifest lookup. SkillGuard's numbers argue for running both layers rather than treating either as sufficient alone. A catalog that only checks manifests would still pass every content-only attack this paper flags as unresolved.

For anyone deciding whether to turn a system like this on, the honest cost sits in the completion and overhead numbers, not the injection-reduction ones: 6.5 points of benign task completion, plus wall-clock effects that vary enough by scaffold that a blanket policy is the wrong default. The Claude Code result — gating sped things up by ending attacks early — is the best case in the paper, not the typical one; Codex CLI ran 92.1% slower under the same framework.

Skills related to this research

Privesc Linpeas Privesc Linpeas runs comprehensive post-exploitation scans to uncover privilege escalation opportunities on Linux systems, checking for SUID/SGID binaries, sudo misconfigurations, exposed credentials, and kernel vulnerabilities. Results are color-coded by severity and mapped to exploitation techniques, enabling rapid identification of the highest-confidence escalation paths during authorized penetration tests and red team engagements.★ 181 Linux Pentesting Commands Linux Pentesting Commands organizes shell commands across the full penetration testing lifecycle: reconnaissance, enumeration, exploitation, privilege escalation, and post-exploitation. It covers reconnaissance techniques, service discovery, SUID/capability enumeration, reverse shells, sudo exploitation, and persistence methods with practical examples.★ 8 create-control-manifest This skill transforms accepted architecture decision records into a single, layer-organized reference guide that tells programmers exactly what to do and what to avoid. It pulls rules from ADRs, technical preferences, and engine docs, then surfaces them by Foundation, Core, Feature, and Presentation layers—answering "what do I do?" faster than reading the reasoning behind each decision.★ 23,424 xcodebuildmcp-tool-contract-review This skill enables contract validation and review workflows for XcodeBuildMCP, an MCP server that equips agents with build and development tools for iOS and macOS work. Use it to audit tool definitions, ensure interface consistency, and catch breaking changes before deployment.★ 6,155

Related notes

References

Pan, S., Sun, X., Zhang, T., Liao, D., Yang, K., & Xing, Z. (2026). SkillGuard: A Permission-Centric Framework for Agent Skill Security. arXiv:2606.03024.
Saltzer, J. H., & Schroeder, M. D. (1975). The Protection of Information in Computer Systems. Proceedings of the IEEE.
Felt, A. P., Chin, E., Hanna, S., Song, D., & Wagner, D. (2011). Android Permissions Demystified. ACM CCS.
Greshake, K., Abdelnabi, S., Mishra, S., Endres, C., Holz, T., & Fritz, M. (2023). Not What You've Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection. arXiv:2302.12173.