Indirect Prompt Injection via Tool/Skill Output Contamination (SkillGuard Defense Research)

Technical Analysis

The underlying threat class is indirect prompt injection: LLM agents ingest outputs from external tools/skills into their execution context, and attacker-controlled data embedded in that output can influence subsequent privileged actions (e.g., calling sensitive tools like Slack integrations). The entry point is any tool/skill response that an attacker can influence (documents, web content, API responses) which gets placed into agent context without being flagged as untrusted. If unmitigated, the attacker gains the ability to hijack the agent's planning/execution flow to perform unauthorized actions crossing from a low-privilege data source into high-privilege tool invocation. The paper's contribution (SkillGuard) is a countermeasure: it models security-relevant transitions via a Skill Impact Graph and dynamically restricts capabilities after contamination is detected, without requiring additional LLM inference calls, thereby reducing attack success rates in AgentDojo-based evaluations.

Affected Systems

AgentDojo, CaMeL, AttriGuard, Spotlighting

Detection Signatures

• Tool/skill output containing embedded imperative instructions directed at the agent (e.g., 'ignore previous instructions', 'now call tool X with Y')
• Sudden shift in agent tool-call sequence immediately following ingestion of external/untrusted content
• ToolResult fields containing natural-language directives rather than expected data schema
• Unexpected invocation of high-privilege tools (e.g., messaging, file write, credential access) shortly after processing third-party content
• Log correlation between untrusted data ingestion events and subsequent privileged tool calls without intervening user confirmation

Remediation Steps

1. 1

   Adopt capability confinement after untrusted data ingestion

   Implement harness-level policies (as in SkillGuard) that automatically restrict the agent's future tool/action space once content from an untrusted or external source enters its context, rather than relying solely on classification of the content itself.

2. 2

   Use reference monitors for tool invocation

   Mediate all tool/skill calls through an inline reference monitor that checks proposed actions against deployer-defined forbidden states and current contamination level.

3. 3

   Apply least-privilege and fractional capability restriction

   Where full capability revocation harms utility, use fractional or fractional-flow restriction strategies to limit only the specific capabilities reachable from contaminated state, preserving benign functionality.

4. 4

   Benchmark agents against compositional injection attacks

   Test agent deployments against attack suites (e.g., AgentDojo) that combine multiple individually benign-looking observations, not just single-shot injection strings.

5. 5

   Isolate high-impact tools behind human confirmation

   Require explicit human-in-the-loop approval for irreversible or high-impact actions (e.g., external communications, financial transactions) triggered soon after ingesting third-party content.