SkillSonar adds runtime safety checks for skill-augmented agents
The deployment detail matters: a guard skill installed but never invoked left agents exposed, so teams must enforce explicit consultation in system prompts, not just add it to the skill library. The defense-as-skill design means existing agent frameworks can adopt runtime checking without architectural changes. Builders shipping third-party skills should read the arXiv paper (2609.01487) and pair it with sandboxing and permission layers.
A paper titled "Defense-as-Skill: Evolving Runtime Guard Skill for Skill-Augmented Agents" proposes SkillSonar, a safety skill that monitors sensitive actions while an agent works and decides whether to allow, narrow, replan or ask the user.
The motivation is that a malicious agent skill can appear safe at install time and turn dangerous only during a real task, once it has access to files, tools, credentials or external services.
On GLM-5, SkillSonar cut attack success from 48.2% to 10.
4% on familiar attack types and from 60.6% to 11.
5% on unseen risk families.The paper also finds that merely installing the safety skill was much weaker;
the agent had to be explicitly instructed to consult it before acting.It recommends combining pre-install scanning, runtime checks and hard protections like permissions and sandboxing.
A malicious agent skill can look safe when installed and turn dangerous only during a real task, so this paper argues that agents need runtime safety checks, not just pre-install scanning.
The problem is timing: a bad skill can wait until the agent has access to useful files, tools, credentials, or external services before pushing it beyond what the user actually asked for.
The paper proposes SkillSonar, a safety skill that checks sensitive actions while the agent is working and decides whether to allow them, narrow them, replan, or ask the user first.
On GLM-5, it cut attack success from 48.2% to 10.4% on familiar attack types and from 60.6% to 11.5% on unseen risk families.
A crucial result: simply installing the safety skill was much weaker.
The agent had to be explicitly told to consult it before acting.
overall, the paper says scan skills before installation, check their actions during execution, and still keep hard protections like permissions and sandboxing underneath.
– arxiv. org/abs/2609.01487
Title: "Defense-as-Skill: Evolving Runtime Guard Skill for Skill-Augmented Agents"
This report is categorized under AITOP's "Papers" desk, focusing on China's AI industry and domestic foundation model ecosystem. Within our cross-regional analytical framework, it directly maps to AI developer toolchains, coding agents, and engineering workflows and AI regulation, compliance frameworks, and sovereign compute policy. Key entities and technical topics under continuous tracking include SkillSonar, GLM, agents, AI safety.
Source attribution: curated from rohanpaul_ai (@rohanpaul_ai).