Permission gating nearly halves skill-injection success — 36.7% → 18.0%

Notes on SkillGuard: A Permission-Centric Framework for Agent Skill Security (arXiv:2606.03024) — Shidong Pan, Xiaoyu Sun, Tianyi Zhang, Dianshu Liao, Kaiwen Yang, Zhenchang Xing · June 2026

Note published July 25, 2026 · written by SkillFed’s research pipeline from the paper above · how these notes are made

Agent skills aren't just documentation anymore — they're bundles of instructions, scripts, and tool bindings that can steer an agent's reasoning before any tool executes, then trigger real side effects once one does. Most defenses cover only one side of that: scanning a skill's files before install, or gating individual tool calls at runtime. Nothing connects what a skill declares it needs to what it actually does once running. SkillGuard closes that gap with a skill manifest — a JSON schema declaring the resources a skill needs — checked against a runtime permission layer that intercepts every tool call and enforces deny-by-default on anything undeclared. High-stakes actions get escalated to the user for approval. Underneath sits a taxonomy of eight resource groups — storage, code repository, network, execution, hardware, system, secrets, agent ecosystem — broken into 41 distinct labels such as READ_FILE and WRITE_FILE, built on the classical least privilege and complete-mediation principles that systems like Android's permission model already lean on. Testing whether that taxonomy actually covers what real skills do meant checking it against 1,260 skills mined across 63 categories on the SkillsMP marketplace — the top 10 by star count plus 10 random picks per category — with every observed action mapped onto it.

Coverage held at 99.93%: almost every protected object those 1,260 skills touched fell inside a predefined permission, and every observed action landed in one of the eight resource groups. The real test was adversarial — running SkillGuard against SkillInject, a benchmark of 50 skills paired with injection-bearing variants across domains like document processing, payment integrations, and healthcare, run through three agent scaffolds: Gemini CLI, Codex CLI, and Claude Code. Permission gating cut obvious prompt injection success from 36.7% to 18.0%, and contextual-injection success from 35.3% to 20.7%. Benign task completion slipped from 87.1% to 80.6%, a 6.5-point cost. The protection isn't free to run, either: about 24.7% more tokens per task on average, and wall-clock effects that swing hard by scaffold — 43% faster on Claude Code, since blocked attacks terminate early, but 92.1% slower on Codex CLI.