Defense-as-Skill: Evolving Runtime Guard Skill for Skill-Augmented Agents
Skill-augmented agents load reusable skills as persistent runtime context, improving task performance but also giving malicious skills a durable channel for steering future actions. Such skills may leak secrets, corrupt code, bypass approvals, or stage data for exfiltration only after a concrete user task and workspace state make the unsafe action appear useful. This makes pre-install vetting insufficient and calls for runtime, task-conditioned protection. The paper proposes Defense-as-Skill, a defense paradigm that implements the runtime guard itself as an installable, inspectable, and editable skill. The guard, SkillSonar, runs alongside untrusted task skills and checks sensitive actions against the user's task boundary, routing each action to an allow, replan, or confirmation decision without modifying the underlying agent runtime. The study constructs SCOPE-R, a task-conditioned dataset covering 6 risk families and 21 sub-categories, with 206 attack-confirmed malicious instances and 43 benign tasks. SkillSonar is improved on the SCOPE-R training subset using runtime guard-skill evolution, a Monte-Carlo Tree Search procedure that evolves the on-disk guard skill.
A research paper introduces Defense-as-Skill, a paradigm where the runtime guard for skill-augmented agents is itself an installable, inspectable, and editable skill. The proposed guard, SkillSonar, runs alongside untrusted task skills and checks sensitive actions against the user's task boundary, routing each action to allow, replan, or confirmation without modifying the agent runtime. The paper also presents SCOPE-R, a task-conditioned dataset with 206 malicious instances and 43 benign tasks across 6 risk families and 21 sub-categories, and uses Monte-Carlo Tree Search to evolve the guard skill.
The approach treats the guard as a skill that can be evolved via Monte-Carlo Tree Search, enabling runtime adaptation to task-conditioned threats. SkillSonar operates without modifying the underlying agent runtime, suggesting a modular, non-invasive security layer. The SCOPE-R dataset provides a benchmark for task-conditioned attacks, covering 6 risk families and 21 sub-categories, which may facilitate further research on runtime guard evolution.
As skill-augmented agents become more common, the need for runtime, task-conditioned security controls increases. Defense-as-Skill could lower the barrier for deploying guards by making them installable and editable, similar to other skills. This may influence how agent platforms and enterprise AI systems handle third-party skill security.
The research addresses a critical security gap in skill-augmented agents, potentially reducing risks of data exfiltration, code corruption, and approval bypass. For enterprises deploying agent systems, a runtime guard skill could provide a practical, inspectable security control without requiring changes to the agent runtime.
Observable next signals include adoption of Defense-as-Skill in agent frameworks, publication of follow-up studies using SCOPE-R, and development of commercial runtime guard skills. The evolution of guard skills via search may lead to more adaptive security mechanisms for autonomous agents.