A skill security distribution method and system for an AI agent

Abstract

A skill security distribution method and system for an AI agent, which comprises, in response to acquisition of skill package data, performing threat signature-based pattern matching analysis on text files in the skill package data to generate scanning result data; when the security level information is less than a preset level threshold, registering the skill package data to a runtime skill list, and writing the security level information as installed risk level information to the runtime skill list; in response to a tool invocation request in the runtime skill list, reading the corresponding installed risk level information, and performing multi-guard collaborative evaluation on the tool invocation request to generate a first evaluation result including first risk level information and first discovery list information; comparing the first risk level information with the installed risk level information, and taking the higher risk level as the final risk level information; and performing approval decision of the tool invocation request according to the final risk level information.

Description

Technical Field

[0001] This invention relates to the fields of artificial intelligence and cybersecurity, and in particular to a method and system for secure skill distribution to AI agents. Background Technology

[0002] AI agents driven by large language models can autonomously invoke external tools such as file reading and writing, shell command execution, and network requests to complete complex tasks. Third-party developers extend the agent's capabilities by writing skill packages, while users acquire these packages from skill marketplaces or GitHub and install them into the agent's runtime environment. However, existing technologies suffer from the following problems in the skill distribution and tool invocation process: First, there is a lack of security checks before skill packs are installed. The instruction files within skill packs may embed hint injection instructions, while script files may contain data-stealing code or hard-coded keys. Existing static security testing tools rely on syntax parsing, which cannot detect Markdown instruction files or identify hint injection attack patterns. Once installed, skill packs gain local file access to the agent; if malicious skills are installed, it will directly lead to data leakage.

[0003] Second, the precision of runtime tool call control is insufficient. Existing frameworks employ tool-level blacklists and whitelists, deciding whether to allow a call solely based on the tool name, failing to detect the specific parameters of the tool call. For risky scenarios such as executing network download code via pipes in shell commands or unauthorized access to key directories during file operations, existing solutions cannot identify and intervene in risk patterns in the parameters before the tool is executed.

[0004] Third, the security status of each stage of skill distribution is isolated, lacking information sharing. Scan results during skill installation are discarded immediately after installation, and the runtime interception module cannot utilize previously discovered risk information for that skill. If a tool call is intercepted, subsequent calls to the same tool using the same skill require a complete re-execution of the detection process. The lack of a security information sharing mechanism between stages leads to both duplicate detections and detection blind spots.

[0005] Therefore, existing technologies suffer from insufficient safety management of AI agent skills. Summary of the Invention

[0006] To address the aforementioned technical problems, this invention provides a method for secure skill distribution to AI agents, comprising the following steps: In response to the acquisition of skill pack data, a threat signature-based pattern matching analysis is performed on the text file in the skill pack data to generate scan result data including security level information; When the security level information is less than a preset level threshold, the skill package data is registered to the runtime skill list, and the security level information is written into the runtime skill list as installed risk level information; In response to a tool call request in the runtime skill list, the corresponding installed risk level information is read, and a multi-guardian collaborative assessment is performed on the tool call request. The multi-guardian collaborative assessment includes at least: obtaining the runtime context information of the agent and transmitting it to each guard instance; scheduling at least two guard instances to perform security checks on the tool name and parameter information in the tool call request in parallel; and generating a first assessment result including a first risk level information and a first discovery list information based on the detection results of each guard instance. The first risk level information is compared with the installed risk level information, and the one with the higher risk level is taken as the final risk level information. The approval decision for the tool invocation request is made based on the final risk level information.

[0007] Optionally, the approval decision for the tool invocation request is executed based on the final risk level information, including: When the final risk level information is less than the first preset threshold, the tool call request is allowed. When the final risk level information is greater than or equal to the first preset threshold and less than the second preset threshold, risk summary information is extracted from the first discovery list information and written into the dialogue memory of the agent, and the tool call request is allowed. When the final risk level information is greater than or equal to the second preset threshold, the tool call request is blocked, a rejection message with a rejection flag is generated and written into the agent's dialogue memory.

[0008] Optionally, after extracting risk summary information from the first discovery list information and writing it into the agent's dialogue memory, and allowing the tool call request, the method further includes: Obtain subsequent tool invocation requests generated by the agent in subsequent inference; Based on the subsequent tool call request, the multi-guard collaboration assessment is re-executed to obtain a second assessment result including second risk level information and second discovery list information; The second discovery list information is compared with the first discovery list information to determine whether the second discovery list information includes the same threat signature identifier or the same threat category information as the first discovery list information; if not, the subsequent tool call request is allowed; if so, the subsequent tool call request is blocked.

[0009] Optionally, perform threat signature-based pattern matching analysis on the text files in the skill pack data, including: Load rule file information, including a list of regular expression patterns and a list of exclusion patterns; The text file content is matched line by line with the regular expressions in the regular expression pattern list; if a match is successful, it is checked whether the matched text fragment hits the exclusion pattern list; if not, discovery record information including first threat category information, first severity level information and first matching context information is generated. Security level information is determined based on the first severity level information in all discovery records, and all discovery records are aggregated with the security level information to form scan result data.

[0010] Optionally, the runtime context information of the agent is obtained and transmitted to each guard instance, including: Read the agent's current workspace directory information, user session identifier information, and dialogue history information to construct context information; Transmit the context information to the guard engine instance; When the guard engine instance calls each guard instance to perform security checks, it transmits the current working directory information in the context information to the file path guard instance, and transmits the user session identifier information and the dialogue history information to the rule guard instance.

[0011] Optionally, the file path guard instance obtains the path string included in the parameter information, completes the relative path in the path string into an absolute path according to the current workspace directory information, parses the completed absolute path into a canonical absolute path, performs prefix matching on the canonical absolute path and a predefined set of sensitive paths, and if the match is successful, it is determined to be unauthorized access; when the tool name is a Shell command-type tool, the file path guard instance also parses the redirection operator from the parameter information and extracts the target path after the redirection operator, and performs target path completion, absolute path parsing and prefix matching on the target path.

[0012] Optionally, the rule guard instance converts the parameter information into a string as the text to be detected, and matches the text to be detected with the regular expressions in the runtime rule set; if the match is successful, it checks whether the matched text fragment hits the exclusion expression in the runtime rule set; if it does not hit, it generates a runtime discovery record including second threat category information, second severity level information, and second matching content information.

[0013] Optionally, each guard instance performs security checks in parallel, and a first evaluation result is generated based on the detection results of each guard instance, including: Each guard instance obtains the tool name and parameter information from the tool call request as detection input and independently performs security detection; After all security checks have been completed or timeout conditions have been met, obtain the guard discovery record information returned by each guard instance, which includes security judgment result information, severity level information, and discovery content information. Perform a logical AND operation on the security assessment results in the records of each guard. If any security assessment result is unsafe, then the first assessment result is marked as unsafe. Extract the severity level information from the records of each guard and take the maximum value as the first risk level information; Merge the discovery information from all guard discovery records to generate a first discovery list; Based on the labeling of the first assessment result, the first risk level information, and the first discovery list information, a first assessment result is generated.

[0014] Optionally, when there are multiple tool call requests, the tool name and parameter information in each tool call request are extracted one by one, and the multi-guard collaboration assessment is performed independently for each tool call request; and when any tool call request is blocked, the remaining tool call requests are kept to be executed according to their respective approval decision results.

[0015] Corresponding to the aforementioned skill security distribution method for AI agents, the present invention provides a skill security distribution system for AI agents, comprising: The skill pack scanning module is used to respond to the acquisition of skill pack data, perform threat signature-based pattern matching analysis on the text files in the skill pack data, and generate scan result data including security level information; The skill registration module is used to register the skill package data to the runtime skill list when the security level information is less than a preset level threshold, and to write the security level information as installed risk level information into the runtime skill list. The multi-guardian collaborative assessment module is used to respond to tool call requests in the runtime skill list, read the corresponding installed risk level information, and perform multi-guardian collaborative assessment on the tool call request; the multi-guardian collaborative assessment includes at least: obtaining the runtime context information of the agent and transmitting it to each guard instance, scheduling at least two guard instances to perform security checks on the tool name and parameter information in the tool call request in parallel, and generating a first assessment result including a first risk level information and a first discovery list information based on the detection results of each guard instance; The risk level merging module is used to compare the first risk level information with the installed risk level information, and take the one with the higher risk level as the final risk level information. The approval decision module is used to make an approval decision on the tool call request based on the final risk level information.

[0016] Compared with the prior art, the present invention has the following beneficial effects: (1) By performing threat signature-based pattern matching analysis on the text files in the skill package data and generating scan result data, static security detection before skill package installation is realized; by writing security level information as installed risk level information into the runtime skill list, a channel for information transmission from the security status during installation to the runtime is established, enabling the runtime to reuse historical risk information from the skill installation stage; by obtaining the runtime context information of the agent and transmitting it to each guard instance, and simultaneously scheduling at least two guard instances to perform security detection on the tool name and parameter information in the tool call request in parallel, multi-dimensional and refined detection of the tool call parameter content is realized; by comparing the first risk level information with the installed risk level information and taking the one with the higher risk level as the final risk level information, the collaborative fusion assessment of static risk during installation and dynamic risk during runtime is realized, allowing the approval decision to take into account both the inherent risk of the skill package and the real-time risk of the specific call scenario, thus improving the comprehensiveness of the security assessment.

[0017] (2) By dividing the final risk level information into three threshold ranges and implementing differentiated approval decisions for each, a risk-level response was achieved: low-risk calls were directly allowed to ensure the efficiency of the agent's execution; medium-risk calls were allowed while writing risk summary information into the dialogue memory, enabling the agent to perceive the risk context in subsequent reasoning; high-risk calls were blocked and a rejection flag was written to prevent dangerous operations from being executed. This differentiated processing mechanism ensures the effectiveness of security control while avoiding the impact of a "one-size-fits-all" blocking on the smoothness of the agent's task execution, achieving a balance between security and availability.

[0018] (3) When the tool is called in the future, the threat signature or threat category information in the second discovery list information is compared with the threat signature or threat category information in the first discovery list information to realize the correlation detection of the historical risk discovery of the same skill and the subsequent call; when the duplicate threat type appears, it is blocked, which not only avoids the waste of computing resources caused by repeated detection of the same risk, but also continuously monitors whether the skill attempts to repeatedly initiate the call with the same attack mode, thus improving the pertinence and efficiency of runtime security detection.

[0019] (4) By loading rule file information containing a regular expression pattern list and an exclusion pattern list, and adopting a two-level detection mechanism of "regular expression matching first, and exclusion pattern filtering later", the accurate identification of threat signatures in text files is achieved: the regular expression pattern list is used to capture potential threat fragments, and the exclusion pattern list is used to exclude false positive matches, thereby reducing the false positive rate while ensuring detection coverage; by aggregating the matching results into discovery records containing threat category, severity level and matching context, and determining security level information accordingly, a structured quantitative basis is provided for subsequent risk classification approval.

[0020] (5) By reading the current workspace directory information, user session identifier information and dialogue history information to construct context information, and distributing the context information to different types of guard instances as needed, the divide-and-conquer utilization of context information is realized; each guard instance only obtains the context subset required by its detection logic, which avoids interference of irrelevant information with the detection logic, and enables different guard instances to perform accurate judgments based on runtime environment information related to their detection dimensions, thereby improving the accuracy and professionalism of multi-guard collaborative evaluation.

[0021] (6) By using the file path guard instance to complete the path string in the parameter information into a normal absolute path and performing prefix matching with the sensitive path set, the system can accurately identify the path privilege escalation risk in the file operation parameters, solving the problem that the existing technology cannot detect the specific path risk in the parameters. When the tool name is a Shell command tool, the system further parses the redirection operator and extracts the target path to perform the same security detection, realizing the coverage detection of hidden file operations in Shell commands (such as writing to sensitive directories through redirection), filling the security blind spot of redirection scenarios in parameter detection.

[0022] (7) The parameter information is converted into a string form as the text to be detected by the rule guard instance, and matched with the regular expression and exclusion expression in the runtime rule set, realizing the runtime dynamic rule detection of the tool call parameter content. This detection mechanism is independent of the tool type and can perform text-level threat pattern scanning on the parameter information of any tool. It complements the path dimension detection of the file path guard instance and jointly improves the coverage of parameter risk in multi-guard collaborative assessment.

[0023] (8) By independently performing security checks on each guard instance and aggregating the results after all checks are completed or timeouts occur, collaborative decision-making for parallel multi-guard detection is achieved: A logical AND operation is performed on each security judgment result to ensure that if any guard is deemed unsafe, the entire system is marked as unsafe, thus improving the rigor of security checks; the maximum value of the severity level information of each guard is taken as the first risk level information, ensuring that the risk level reflects the most severe single risk discovery. This invention ensures the reliability of security judgments while maintaining detection efficiency through a conservative aggregation strategy.

[0024] (9) By extracting the tool name and parameter information from each tool call request and performing multi-guard collaboration assessment independently, independent risk judgment of each call in batch tool calls is realized, avoiding the problem of a single high-risk call being diluted or masked by a low-risk call in batch calls; by keeping the remaining tool call requests executed according to their respective approval decision results when any tool call request is blocked, fine-grained isolation control in batch calls is realized, ensuring that risky calls are accurately blocked while not affecting the normal execution of other safe calls in the same batch, thus improving the security and stability of the agent's batch task execution. Attached Figure Description

[0025] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this invention, illustrate exemplary embodiments of the invention and are used to explain the invention, but do not constitute an undue limitation of the invention. In the drawings: Figure 1 This is a simplified flowchart of an embodiment of the skill security distribution method for AI intelligent agents according to the present invention; Figure 2 This is a framework diagram of an embodiment of the skill security distribution system for AI intelligent agents according to the present invention. Detailed Implementation

[0026] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0027] like Figure 1 As shown, the present invention provides a method for secure skill distribution to AI agents, which includes the following steps: In response to the acquisition of skill pack data, a threat signature-based pattern matching analysis is performed on the text files in the skill pack data to generate scan result data including security level information; When the security level information is less than the preset level threshold, the skill package data is registered to the runtime skill list, and the security level information is written to the runtime skill list as the installed risk level information. In response to a tool call request in the runtime skill list, the corresponding installed risk level information is read, and a multi-guardian collaborative assessment is performed on the tool call request. The multi-guardian collaborative assessment includes at least: obtaining the runtime context information of the agent and transmitting it to each guard instance, scheduling at least two guard instances to perform security checks on the tool name and parameter information in the tool call request in parallel, and generating a first assessment result including first risk level information and first discovery list information based on the detection results of each guard instance. The first risk level information is compared with the installed risk level information, and the one with the higher risk level is taken as the final risk level information. The approval decision for the execution tool call request is based on the final risk level information.

[0028] This invention achieves static security detection before skill package installation by performing threat signature-based pattern matching analysis on text files in skill package data and generating scan result data. It establishes an information transmission channel from the security status during installation to runtime by writing security level information as installed risk level information into the runtime skill list, allowing the runtime to reuse historical risk information from the skill installation phase. By acquiring the runtime context information of the agent and transmitting it to each guard instance, and simultaneously scheduling at least two guard instances to perform parallel security checks on the tool name and parameter information in the tool call request, it achieves multi-dimensional and refined detection of tool call parameter content. Finally, by comparing the first risk level information with the installed risk level information and taking the higher risk level as the final risk level information, it achieves a collaborative and integrated assessment of static risks during installation and dynamic risks during runtime, allowing approval decisions to consider both the inherent risks of the skill package and the real-time risks of the specific call scenario, thus improving the comprehensiveness of security assessment.

[0029] In this embodiment, the approval decision for the tool invocation request based on the final risk level information includes: When the final risk level information is less than the first preset threshold, the release tool is invoked. When the final risk level information is greater than or equal to the first preset threshold and less than the second preset threshold, risk summary information is extracted from the first discovery list information and written into the agent's dialogue memory, and the tool call request is allowed. When the final risk level information is greater than or equal to the second preset threshold, the tool call request is blocked, a rejection message with a rejection flag is generated, and written into the agent's dialogue memory. Preferably, the first preset threshold and the second preset value are preset to correspond to the risk level according to actual needs.

[0030] Specifically, the rejection message includes the final risk level information, up to three discovery descriptions and corresponding remediation suggestions, and is appended to the end of the dialogue history as a temporary system message. At the same time, the monitoring agent generates tool calls in the next round of inference. If the subsequent tool calls no longer contain the same risk characteristics, it is determined that the correction is successful and is allowed. If the agent ignores the warning and initiates the same risk operation again, the request is automatically upgraded to HIGH level processing and forcibly blocked.

[0031] Furthermore, when the final risk level information is greater than or equal to the second preset threshold, the process also includes: checking whether a user session identifier exists in the current session; if it exists, initiating an asynchronous user approval request and waiting for the user to return an approval, rejection, or timeout decision; if it does not exist, directly rejecting the tool call request, generating a rejection message with a rejection flag and writing it into the agent's dialogue memory, and the agent automatically adjusting the tool call strategy after reading the message in subsequent inference.

[0032] This invention achieves risk-level response by dividing the final risk level information into three threshold ranges and implementing differentiated approval decisions for each: low-risk calls are directly allowed to ensure the efficiency of the agent's execution; medium-risk calls are allowed while simultaneously writing risk summary information into the dialogue memory, enabling the agent to perceive the risk context in subsequent reasoning; high-risk calls are blocked and marked with a rejection flag to prevent dangerous operations from being executed. This differentiated processing mechanism ensures the effectiveness of security control while avoiding the impact of a "one-size-fits-all" blocking on the smoothness of agent task execution, achieving a balance between security and availability.

[0033] In this embodiment, risk summary information is extracted from the first discovery list information and written into the agent's dialogue memory. After the permission tool invocation request, the process further includes: Obtain subsequent tool invocation requests generated by the agent during subsequent inference; Based on subsequent tool call requests, the multi-guard collaboration assessment is re-executed to obtain a second assessment result that includes second risk level information and second discovery list information. The second discovery list information is compared with the first discovery list information to determine whether the second discovery list information includes the same threat signature identifier or the same threat category information as the first discovery list information; if not, subsequent tool call requests are allowed; if so, subsequent tool call requests are blocked.

[0034] This invention, when calling tools in subsequent calls, compares the threat signature or threat category information in the second discovery list with that in the first discovery list, thus achieving correlation detection between historical risk discovery and subsequent calls of the same skill. When duplicate threat types are found, they are blocked, which not only avoids the waste of computing resources caused by repeatedly detecting the same risk, but also continuously monitors whether the skill attempts to repeatedly initiate calls with the same attack mode, improving the targeting and efficiency of runtime security detection.

[0035] In this embodiment, threat signature-based pattern matching analysis is performed on the text files in the skill pack data, including: Load rule file information, including a list of regular expression patterns and a list of exclusion patterns; The text file content is matched line by line with the regular expressions in the regular expression pattern list; if a match is successful, it is checked whether the matched text fragment hits the exclusion pattern list; if not, discovery record information including the first threat category information, the first severity level information and the first matching context information is generated. The security level information is determined based on the highest severity level information among all discovery records (taking the most severe level information among the highest severity level information), and all discovery records information and security level information are aggregated into scan result data; which includes whether it is safe, the total number of discoveries, and security level information.

[0036] Preferably, the security level information is determined using the following formula: , i = [1, N]; in, This represents security level information, with values ​​ranging from [0, 5], where N is the total number of threats detected during the scan. Let i be the weight coefficient of the i-th discovery. Map the first severity level information for the i-th discovery (e.g., first severity level information: INFO=1, first severity level information: LOW=2, first severity level information: MEDIUM=3, first severity level information: HIGH=4, first severity level information: CRITICAL=5), and take the maximum weighted severity among all discoveries. That is, as long as there is one high-risk discovery, the whole is judged as high-risk.

[0037] Specifically, the rule file is a threat signature rule file in YAML format. Each rule includes a rule identifier, target tool name, target parameter name list, threat category, severity level, regular expression pattern list, exclusion pattern list, description information, and remediation suggestion information. In this embodiment, eight types of YAML threat signature rule files are loaded, covering threat categories including command injection, data theft, key hardcoding, code obfuscation, hint injection, social engineering, supply chain attacks, and unauthorized tool use. The covered threat categories are shown in the table below.

[0038] Table 1. Example of threat categories covered by 8 types of YAML threat signature rule files

[0039] Preferably, the discovery log information includes a unique identifier, rule identifier, threat category, severity level, matching tool name, parameter name, matching value, matching mode, context fragment, and remediation suggestions; the severity level is adjusted according to the severity level override configuration of the scanning strategy engine. The scanning strategy engine also supports configuring an allowed list, customizing file classification rules, setting file quantity limits and single file size limits via YAML configuration files, and marking binary files as lazy files to skip scanning.

[0040] This invention achieves accurate identification of threat signatures in text files by loading rule file information containing a regular expression pattern list and an exclusion pattern list, and employing a two-level detection mechanism of "regular expression matching first, then exclusion pattern filtering": the regular expression pattern list is used to capture potential threat fragments, and the exclusion pattern list is used to exclude false positive matches, thereby reducing the false positive rate while ensuring detection coverage; by aggregating the matching results into discovery records containing threat category, severity level and matching context, and determining security level information accordingly, a structured quantitative basis is provided for subsequent risk classification and approval.

[0041] In this embodiment, obtaining the runtime context information of the agent and transmitting it to each guard instance includes: Read the agent's current workspace directory information, user session identifier information, and dialogue history information to construct context information; Transmit context information to the guard engine instance; When the guard engine instance calls each guard instance to perform security checks, it transmits the current working directory information from the context information to the file path guard instance, and transmits the user session identification information and dialogue history information to the rule guard instance.

[0042] Preferably, the guard engine instance adopts the lazy singleton pattern, and its enabling state is controlled by environment variables or switches in the configuration file, and new guard instances are dynamically registered at runtime.

[0043] This invention constructs context information by reading the current workspace directory information, user session identifier information, and dialogue history information, and distributes the context information to different types of guard instances as needed, realizing the divide-and-conquer utilization of context information. Each guard instance only obtains the subset of context required by its detection logic, which not only avoids the interference of irrelevant information on the detection logic, but also enables different guard instances to perform accurate judgments based on runtime environment information related to their detection dimensions, thereby improving the accuracy and professionalism of multi-guard collaborative evaluation.

[0044] In this embodiment, the file path guard instance obtains the path string included in the parameter information, completes the relative path in the path string into an absolute path according to the current workspace directory information, parses the completed absolute path into a canonical absolute path, and performs prefix matching between the canonical absolute path and a predefined set of sensitive paths. If the match is successful, it is determined to be unauthorized access. When the tool name is a Shell command-type tool, the file path guard instance also parses the redirection operator from the parameter information and extracts the target path after the redirection operator, and performs target path completion, absolute path parsing, and prefix matching on the target path.

[0045] Specifically, the file path guard instance performs a five-step normalization process on the path in the tool parameters: First, it expands the user directory identifier to the user's home directory; second, if it is not an absolute path, it appends the current working directory's root directory to it; third, it parses the appended path into a canonical absolute path; fourth, it performs prefix matching between the canonical absolute path and a predefined set of sensitive paths, which is loaded from a configuration file and includes the key storage directory by default; fifth, for shell command-line tools, it parses the redirection operator and extracts the target path following it, performing the same expansion, concatenation, parsing, and prefix matching process on the target path, where the redirection operator is matched in descending order of length to avoid interference from the prefix of short operators. In addition, the file path guard instance also performs enhanced detection for the pipe `rm` command, identifying the pipe `rm` pattern and recursively expanding and matching the command substitution symbols in the command.

[0046] This invention uses a file path guard instance to complete the path string in the parameter information into a standardized absolute path and performs prefix matching with a set of sensitive paths. This achieves accurate identification of path privilege escalation risks in file operation parameters, solving the problem that existing technologies cannot detect specific path risks in parameters. When the tool name is a Shell command-type tool, the redirection operator is further parsed and the target path is extracted to perform the same security detection. This achieves coverage detection of hidden file operations in Shell commands (such as writing to sensitive directories via redirection), filling the security blind spot in redirection scenarios in parameter detection.

[0047] In this embodiment, the rule guard instance converts the parameter information into a string as the text to be detected, and matches the text to be detected with the regular expressions in the runtime rule set. If the match is successful, it checks whether the matched text fragment hits the exclusion expression in the runtime rule set. If it does not hit, it generates a runtime discovery record including the second threat category information, the second severity level information, and the second matching content information.

[0048] Specifically, the rule guard instance loads a runtime signature rule file in YAML format from the directory, performs regular expression matching on the string form of each tool call parameter, and filters false positives through exclusion expressions. For destructive commands, it also additionally detects path traversal and operations outside the workspace. This invention converts parameter information into string form as the text to be detected through the rule guard instance, and matches it with regular expressions and exclusion expressions in the runtime rule set, achieving runtime dynamic rule detection of tool call parameter content. This detection mechanism is independent of tool type and can perform text-level threat pattern scanning on the parameter information of any tool. It complements the path-dimensional detection of the file path guard instance, jointly improving the breadth of parameter risk coverage in multi-guard collaborative assessment.

[0049] In this embodiment, each guard instance performs security checks in parallel, and a first evaluation result is generated based on the detection results of each guard instance, including: Each guard instance obtains the tool name and parameter information from the tool call request as detection input and performs security detection independently. After all security checks have been completed or timeout conditions have been met, obtain the guard discovery record information returned by each guard instance, which includes security judgment result information, severity level information, and discovery content information. Perform a logical AND operation on the security assessment results in the records of each guard. If any security assessment result is unsafe, then the first assessment result is marked as unsafe. Extract the severity level information from the records of each guard and take the maximum value as the first risk level information; Merge the discovery information from all guard discovery records to generate a first discovery list; The first assessment result is generated based on the labeling of the first assessment result, the first risk level information, and the first discovery list information.

[0050] Specifically, the guard engine adopts a priority-based parallel execution model. Each guard instance is independent by default, executing detection tasks simultaneously through a parallel task mechanism. The execution order can be specified through a configuration file; otherwise, the default priority applies. If a fast-fail mode is enabled, high-priority guards detecting high risks will directly short-circuit subsequent checks. This invention achieves collaborative decision-making for multi-guard parallel detection by independently executing security checks for each guard instance and aggregating the results after all checks are completed or timeouts: Logical AND operations are performed on each security judgment result to ensure that if any guard determines the system is unsafe, the entire system is marked as unsafe, improving the rigor of security detection; the maximum value of the severity level information for each guard is taken as the first risk level information, ensuring that the risk level reflects the most severe single risk detection. This invention ensures the reliability of security judgments while maintaining detection efficiency through a conservative aggregation strategy.

[0051] In this embodiment, when there are multiple tool call requests, the tool name and parameter information in each tool call request are extracted one by one, and multi-guard collaboration evaluation is performed independently for each tool call request; and when any tool call request is blocked, the remaining tool call requests are kept to be executed according to their respective approval decision results.

[0052] This invention achieves independent risk assessment for each tool call in batches by extracting the tool name and parameter information from each tool call request and independently performing multi-guardian collaborative assessment. This avoids the problem of a single high-risk call being diluted or masked by a low-risk call in batches. By ensuring that the remaining tool call requests are executed according to their respective approval decisions when any tool call request is blocked, this invention achieves fine-grained isolation control in batches. This ensures that risky calls are accurately blocked without affecting the normal execution of other safe calls in the same batch, thus improving the security and stability of batch task execution by the agent.

[0053] like Figure 2 As shown, the present invention also provides a skill security distribution system for AI agents, which includes: The skill pack scanning module 10 is used to respond to the acquisition of skill pack data, perform threat signature-based pattern matching analysis on the text files in the skill pack data, and generate scan result data including security level information. The skill registration module 20 is used to register the skill package data to the runtime skill list when the security level information is less than the preset level threshold, and to write the security level information as the installed risk level information into the runtime skill list. The multi-guardian collaborative assessment module 30 is used to respond to tool call requests in the runtime skill list, read the corresponding installed risk level information, and perform multi-guardian collaborative assessment on the tool call requests. The multi-guardian collaborative assessment includes at least: obtaining the runtime context information of the agent and transmitting it to each guard instance, scheduling at least two guard instances to perform security checks on the tool name and parameter information in the tool call request in parallel, and generating a first assessment result including first risk level information and first discovery list information based on the detection results of each guard instance. The risk level merging module 40 is used to compare the first risk level information with the installed risk level information and take the higher risk level as the final risk level information. The approval decision module 50 is used to make approval decisions on tool call requests based on the final risk level information.

[0054] Specifically, the skill pack scanning module 10 also includes a skill acquisition and decompression subcomponent, a file traversal and classification subcomponent, a pattern analyzer, a scanning strategy engine, and a scanning result aggregator.

[0055] The Skill Acquisition and Decompression sub-component is used to acquire skill packages from four sources: GitHub repositories, ZIP archives, Skill Market Hub, and LobeHub compatible formats. After downloading, the packages are decompressed to a temporary directory and await scanning.

[0056] The file traversal and classification subcomponent is used to traverse all files in the skill pack directory, marking text files as needing to be scanned according to the file classification rules defined in the scanning strategy, and marking binary files as lazy files to be skipped directly.

[0057] The pattern analyzer is the core of the scanning engine, used to perform multi-rule regular expression matching on the content of each text file and load 8 types of YAML threat signature rule files.

[0058] The scanning strategy engine allows you to adjust scanning behavior via a YAML configuration file, including severity levels of coverage rules, configuration of allowed lists, custom file classification rules, and setting limits on the number of files and the size of a single file.

[0059] The scan results aggregator is used to summarize the findings of all analyzers into a scan results object, which includes whether it is safe, the total number of findings, the count by severity level, and the highest severity level.

[0060] The multi-guard collaboration assessment module 30 also includes a guard engine, file path guard instances, and rule guard instances.

[0061] The guard engine serves as the scheduling center, employing a lazy singleton pattern to discover, load, and execute all registered guard instances. Its on / off state is controlled via environment variables or configuration files, and it supports dynamically registering new guard instances at runtime.

[0062] The file path guard instance is used to detect the security of file operation tools, including execution path normalization, sensitive path set management, shell redirection detection, and enhanced detection of piped rm commands.

[0063] The rule guard instance is used to load runtime signature rule files in YAML format from the directory, perform regular expression matching on the string form of each tool call parameter, and filter false positives by exclusion expressions.

[0064] The multi-guard collaboration assessment module 30 adopts a priority-based parallel execution model. Each guard instance is independent by default and performs detection simultaneously through a parallel task mechanism.

[0065] The invention will be further illustrated below through specific application scenarios.

[0066] In a specific implementation scenario, a research institute deployed an AI agent platform based on a large language model. Fifteen researchers used the platform for literature retrieval, paper writing, and data analysis. Each person could install third-party skill packs from the skill market to expand the agent's capabilities.

[0067] In practical use, the following requirements apply: installing skills such as "literature review generator" and "patent novelty search tool" from GitHub; skill packages may come from untrusted third parties and need to be automatically detected before installation; sensitive tools such as executing shell commands and file operations during runtime require security control; high-risk operations such as deleting files and accessing key directories require approval; and the activation status of the same skill on the Web console, DingTalk group, and Lark needs to be configured separately.

[0068] System constraints include: security protections must not increase tool call latency by more than 200ms; security rules must support hot updates without requiring a restart of the agent; and the system must be able to run in an offline environment.

[0069] First, deploy and configure the system. Install the intelligent agent platform on the local server and enable three security switches via the configuration file: Tool Guardian, File Guardian, and Skill Scanner. Define file classification rules, severity level coverage, and allowed lists in the scanning policy file.

[0070] Then, the skill was installed. Researcher A clicked to install the "literature-review" skill package from GitHub via the web console. The system downloaded the ZIP package and extracted it to a temporary directory. It then traversed all files, identifying three text files: the SKILL.md command file, the search.py ​​script file, and the config.yaml configuration file. Icons and font files were marked as lazy and skipped. The pattern analyzer loaded eight threat signature rules and began scanning: no hint injection patterns were found in SKILL.md; a MEDIUM-level discovery was found in search.py—shell=True was used to execute a subprocess; no outbound network requests were found in config.yaml. The aggregated result showed a total of 1 discovery, a maximum severity level of MEDIUM, and a safe status. After marking the risk, the system allowed installation and returned a message to the user: "This skill has a MEDIUM-level warning; the script used shell=True to execute a subprocess. It is recommended to change it to a list parameter format."

[0071] Registration and configuration then proceed. The skill package is copied to the skills directory in the workspace, and the skill metadata (name, description, version, source, etc.) is registered to the runtime skill registry. Researcher A enables the skill in the web console and DingTalk channel, but keeps it disabled in the Lark channel.

[0072] Next, runtime interception occurs. Researcher A sends a command to the agent: "Retrieve research papers on large model security from the past 5 years and generate a review." After inference, the agent outputs a tool call, invoking `execute_shell_command` to execute the `curl` command and pipe the downloaded content to the Python interpreter for execution. The interceptor intercepts this call during the `_acting` phase: the file path guard detects that the `curl` pipe output does not involve sensitive paths, thus determining it as safe; the rule guard matches the `curl.|.python` rule, which directly pipes downloaded content to the Python interpreter for execution, posing a code injection risk with a severity level of HIGH. The highest severity level in the aggregation result is HIGH. The third-level decision proceeds to the HIGH branch: pause execution, format the risk summary information, and initiate user approval. Researcher A sees the message "Pipes downloaded content directly to the Python interpreter for execution, posing a code injection risk" in the web console and chooses to reject the request.

[0073] Finally, the feedback loop is entered. Upon receiving rejection feedback, the agent adjusts its strategy, changing to step-by-step execution: first, it executes `curl -o / tmp / search.py` to download the file (safe, allow); then, it executes `read_file` to read the contents of ` / tmp / search.py` (safe, allow); finally, it executes `python / tmp / search.py` to run the reviewed file (safe, allow). The entire security protection is transparent to the agent's reasoning logic; the researcher only clicked "reject" once during the approval process. Rejected tool calls leave a structured rejection message with a rejection mark in the dialogue memory. The agent reads the rejection reason in subsequent reasoning and automatically adjusts its tool call strategy. Downgraded calls inject risk summary information into the context, guiding the agent to autonomously avoid risky operations. Thus, the entire skill distribution process forms a complete security status transmission chain from acquisition, scanning, registration, interception to feedback, with the security results of each stage sequentially passed to the next stage.

[0074] It should be noted that the various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For system embodiments, since they are basically similar to method embodiments, the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

[0075] Furthermore, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0076] The foregoing description illustrates and describes preferred embodiments of the present invention. It should be understood that the present invention is not limited to the forms disclosed herein and should not be construed as excluding other embodiments. It can be used in various other combinations, modifications, and environments, and can be altered within the scope of the inventive concept by means of the foregoing teachings or techniques or knowledge in related fields. Any modifications and variations made by those skilled in the art that do not depart from the spirit and scope of the present invention should be within the protection scope of the appended claims.

Claims

1. A method for secure skill distribution to AI agents, characterized in that, Includes the following steps: In response to the acquisition of skill pack data, a threat signature-based pattern matching analysis is performed on the text file in the skill pack data to generate scan result data including security level information; When the security level information is less than a preset level threshold, the skill package data is registered to the runtime skill list, and the security level information is written into the runtime skill list as installed risk level information; In response to a tool call request in the runtime skill list, the corresponding installed risk level information is read, and a multi-guardian collaboration assessment is performed on the tool call request. The multi-guardian collaborative evaluation includes at least: acquiring the runtime context information of the agent and transmitting it to each guard instance; scheduling at least two guard instances to perform security checks in parallel on the tool name and parameter information in the tool call request; and generating a first evaluation result including first risk level information and first discovery list information based on the detection results of each guard instance. The first risk level information is compared with the installed risk level information, and the one with the higher risk level is taken as the final risk level information. The approval decision for the tool call request based on the final risk level information includes: allowing the tool call request when the final risk level information is less than a first preset threshold; allowing the tool call request when the final risk level information is greater than or equal to the first preset threshold and less than a second preset threshold, extracting risk summary information from the first discovery list information and writing it into the agent's dialogue memory; and allowing the tool call request when the final risk level information is greater than or equal to the second preset threshold, blocking the tool call request, generating a rejection message with a rejection flag and writing it into the agent's dialogue memory. Each guard instance performs security checks in parallel, and a first evaluation result is generated based on the detection results of each guard instance, including: Each guard instance obtains the tool name and parameter information from the tool call request as detection input and independently performs security checks. After all security checks are completed or timeout conditions are met, the guard instance obtains the guard discovery record information returned by each guard instance, which includes security judgment result information, severity level information, and discovery content information. The guard instance performs a logical AND operation on the security judgment result information in each guard discovery record information. If any security judgment result information is unsafe, the first assessment result is marked as unsafe. The severity level information is extracted from each guard discovery record information and the maximum value is taken as the first risk level information. The discovery content information in all guard discovery record information is merged to generate the first discovery list information. Based on the marking of the first assessment result, the first risk level information, and the first discovery list information, the first assessment result is generated.

2. The skill security distribution method for AI intelligent agents according to claim 1, characterized in that, After extracting risk summary information from the first discovery list information and writing it into the agent's dialogue memory, and allowing the tool call request, the process further includes: Obtain subsequent tool invocation requests generated by the agent in subsequent inference; Based on the subsequent tool call request, the multi-guard collaboration assessment is re-executed to obtain a second assessment result including second risk level information and second discovery list information; The second discovery list information is compared with the first discovery list information to determine whether the second discovery list information includes the same threat signature identifier or the same threat category information as the first discovery list information; if not, the subsequent tool call request is allowed; if so, the subsequent tool call request is blocked.

3. The skill security distribution method for AI intelligent agents according to claim 1, characterized in that, Perform threat signature-based pattern matching analysis on the text files in the skill pack data, including: Load rule file information, including a list of regular expression patterns and a list of exclusion patterns; The text file content is matched line by line with the regular expressions in the regular expression pattern list; if a match is successful, it is checked whether the matched text fragment hits the exclusion pattern list; if not, discovery record information including first threat category information, first severity level information and first matching context information is generated. Security level information is determined based on the first severity level information in all discovery records, and all discovery records are aggregated with the security level information to form scan result data.

4. The skill security distribution method for AI agents according to claim 1, characterized in that, Obtain the runtime context information of the agent and transmit it to each guard instance, including: Read the agent's current workspace directory information, user session identifier information, and dialogue history information to construct context information; Transmit the context information to the guard engine instance; When the guard engine instance calls each guard instance to perform security checks, it transmits the current working directory information in the context information to the file path guard instance, and transmits the user session identifier information and the dialogue history information to the rule guard instance.

5. The skill security distribution method for AI intelligent agents according to claim 4, characterized in that, The file path guard instance obtains the path string included in the parameter information, completes the relative path in the path string into an absolute path according to the current workspace directory information, parses the completed absolute path into a canonical absolute path, and performs prefix matching between the canonical absolute path and a predefined set of sensitive paths. If the match is successful, it is determined to be unauthorized access. When the tool name is a Shell command-type tool, the file path guard instance also parses the redirection operator from the parameter information and extracts the target path after the redirection operator, and performs target path completion, absolute path parsing, and prefix matching on the target path.

6. The skill security distribution method for AI agents according to claim 4, characterized in that, The rule guard instance converts the parameter information into a string as the text to be detected, and matches the text to be detected with the regular expressions in the runtime rule set. If the match is successful, it checks whether the matched text fragment hits the exclusion expression in the runtime rule set. If it does not hit, it generates a runtime discovery record including the second threat category information, the second severity level information, and the second matching content information.

7. The skill security distribution method for AI intelligent agents according to claim 1, characterized in that, When there are multiple tool call requests, the tool name and parameter information in each tool call request are extracted one by one, and the multi-guard collaboration assessment is performed independently for each tool call request; and when any tool call request is blocked, the remaining tool call requests are still executed according to their respective approval decision results.

8. A skill security distribution system for AI intelligent agents, characterized in that, include: The skill pack scanning module is used to respond to the acquisition of skill pack data, perform threat signature-based pattern matching analysis on the text files in the skill pack data, and generate scan result data including security level information; The skill registration module is used to register the skill package data to the runtime skill list when the security level information is less than a preset level threshold, and to write the security level information as installed risk level information into the runtime skill list. The multi-guardian collaboration assessment module is used to respond to tool call requests in the runtime skill list, read the corresponding installed risk level information, and perform multi-guardian collaboration assessment on the tool call requests. The multi-guardian collaborative evaluation includes at least the following: acquiring the runtime context information of the agent and transmitting it to each guard instance; scheduling at least two guard instances to perform security checks in parallel on the tool name and parameter information in the tool invocation request; and generating a first evaluation result including a first risk level information and a first discovery list information based on the detection results of each guard instance. The parallel execution of security checks by each guard instance, and the generation of the first evaluation result based on the detection results of each guard instance, includes: each guard instance acquiring the tool name and parameter information in the tool invocation request as detection input and independently performing security checks; and waiting for all security checks to complete or for a timeout to occur. After determining the conditions, obtain the guard discovery record information returned by each guard instance, which includes security judgment result information, severity level information, and discovery content information; perform a logical AND operation on the security judgment result information in each guard discovery record information; if any security judgment result information is unsafe, then the first assessment result is marked as unsafe; extract the severity level information from each guard discovery record information and take the maximum value as the first risk level information; merge the discovery content information in all guard discovery record information to generate the first discovery list information; based on the marking of the first assessment result, the first risk level information, and the first discovery list information, generate the first assessment result. The risk level merging module is used to compare the first risk level information with the installed risk level information, and take the one with the higher risk level as the final risk level information. The approval decision module is used to execute an approval decision on the tool call request based on the final risk level information, including: when the final risk level information is less than a first preset threshold, allowing the tool call request; when the final risk level information is greater than or equal to the first preset threshold and less than a second preset threshold, extracting risk summary information from the first discovery list information and writing it into the agent's dialogue memory, allowing the tool call request; when the final risk level information is greater than or equal to the second preset threshold, blocking the tool call request, generating a rejection message with a rejection flag and writing it into the agent's dialogue memory.

Images