AI RESEARCH
Credential Leakage in LLM Agent Skills: A Large-Scale Empirical Study
arXiv CS.AI
•
ArXi:2604.03070v1 Announce Type: cross Third-party skills extend LLM agents with powerful capabilities but often handle sensitive credentials in privileged environments, making leakage risks poorly understood. We present the first large-scale empirical study of this problem, analyzing 17,022 skills (sampled from 170,226 on SkillsMP) using static analysis, sandbox testing, and manual inspection. We identify 520 vulnerable skills with 1,708 issues and derive a taxonomy of 10 leakage patterns (4 accidental and 6 adversarial.