A method for detecting agent skill poisoning based on cross-skill flow and authorization boundaries

Abstract

This invention relates to the field of large-scale application security technology, specifically to an agent skill poisoning detection method based on cross-skill flow and authorization boundaries. It constructs structured capability tuples by collecting four layers of information on agent skills: declaration, permission implementation, and operation. This is integrated into a cross-skill behavior graph, and upstream and downstream capabilities are combined segment by segment along resource transfer and invocation relationships to form actual capability paths. These paths are then compared element-by-element with authorized capability paths generated according to authorization policies, based on the subject resource operation sequence, destination trigger conditions, and trust attribute vectors. Unauthorized combined capability tuples are detected to determine cross-skill combined capabilities exceeding their boundaries. Based on this, cross-skill taint propagation and capability primitive path matching are performed to identify and split payload-type threat chains. Combined with trigger conditions, an isolation sandbox dynamic verification and static-dynamic check mechanism are generated to reduce false alarms and confirm real risks. Finally, a normalized risk level and a traceable evidence chain are output.

Description

Technical Field

[0001] This invention relates to the field of large-scale application security technology, specifically to a method for detecting agent skill poisoning based on cross-skill flow and authorization boundaries. Background Technology

[0002] Large-scale intelligent agents extend their task execution capabilities by loading skills. Skills typically consist of descriptive text, prompt templates, manifest files, tool bindings, dependent components, and executable scripts. They execute as the host agent and can access file systems, credentials, network interfaces, and external services. With the rise of the skill market, the skill supply chain has become a significant attack surface for agent security. Existing security detection methods use individual skills, tools, or invocations as analysis units, making it difficult to detect complex risks that only arise when multiple skills are combined. For example, skill A reads a sensitive file, skill B encodes or compresses data, and skill C sends data to an external address. Each of these three skills may appear to function normally when checked individually, but when combined in a specific order within an agent's task, they form a complete chain of sensitive data leakage. Some poisoning behaviors also have trigger conditions, activating only when specific tasks, inputs, environment variables, or context states are met. Static analysis struggles to effectively correlate these trigger conditions with cross-skill data flows and permission boundaries.

[0003] To address the aforementioned issues, existing technologies mainly include dangerous keyword matching, sensitive API identification, LLM-based semantic classification, single-skill sandbox execution, and single-call permission verification. These methods generally suffer from the following limitations: First, the analysis unit is singular, making it difficult to identify split-load attack chains that only become apparent after skill combinations; second, permission detection typically compares individual permissions or permission unions, failing to accurately reflect the combined capability breaches formed by resource scope, operation destination, and data transmission relationships; third, static analysis and dynamic verification are disconnected, with statically identified threat chains lacking trigger condition generation and sandbox verification, making it difficult to verify detection results; fourth, full analysis needs to be repeated after skill version updates, resulting in low detection efficiency. This invention aims to solve these problems by constructing a cross-skill behavior graph, establishing capability tuples containing subject delegation chains and trust attribute vectors, and implementing a detection framework that combines static inference and dynamic verification to identify cross-skill composite poisoning and authorization boundary breaching behaviors that single-skill detection cannot detect. Summary of the Invention

[0004] To address the shortcomings of existing technologies, the present invention aims to provide an agent skill poisoning detection method based on cross-skill flow and authorization boundary to solve the problem that existing security detection methods that use a single skill as the analysis unit cannot identify composite poisoning behaviors and authorization boundary overstepping risks formed by multiple skills combined in a specific order.

[0005] To achieve the above objectives, the present invention adopts the following technical solution:

[0006] A method for detecting agent skill poisoning based on cross-skill flow and authorization boundaries includes:

[0007] Obtain the set of skills to be detected, collect the declaration information, permission information, implementation information and operation information of each skill in the set, establish a multi-layered skill security representation with declaration layer, permission layer, implementation layer and operation layer respectively, and construct a skill object graph;

[0008] The capability information in the skill security representation at each layer is converted into structured capability tuples, and the following are obtained: the set of declared capabilities Pdecl, the set of authorized capabilities Pperm, the set of implemented capabilities Pimpl, and the set of observed capabilities Pobs.

[0009] Merge the skill object graphs of each skill, and construct a cross-skill behavior graph based on the skill relationships between different skills;

[0010] For the candidate skill call path π, only adjacent capability tuples with evidence of cross-skill edge and input / output resource association are combined to obtain the actual capability path Cπ; the authorized capability path Aπ is generated according to the authorized capability set Pperm and the preset authorization strategy.

[0011] When the difference set Δπ between the actual ability path Cπ and the authorized ability path Aπ contains an ability tuple that is simultaneously associated with at least two skills, it is determined that the skill set has a cross-skill combination ability overstepping.

[0012] Sensitive resources and untrusted inputs are marked as taint sources, and data leakage operations and high-risk execution operations are marked as danger sinks. The taint labels are propagated along the data flow edges and cross-skill data intersection edges. The taint propagation path is converted into a normalized capability tuple set with the same format as the difference set Δπ. When a taint propagates from a taint source to a danger sink, the propagation path crosses at least one skill boundary, and the difference set Δπ and the normalized capability tuple set have a capability tuple intersection, a cross-skill threat chain is generated. The existence of the cross-skill threat chain is determined to indicate that the skill set has a skill poisoning behavior, and the detection result is output.

[0013] Furthermore, the structured capability tuple is represented as c=(u, r, o, s, d, t, q), where u represents the normalized capability subject and delegation chain, r represents a resource pair consisting of input resource r_in and output resource r_out, o represents the operation sequence arranged in the order of execution, s represents the resource scope, d represents the operation destination, t represents the triggering condition, and q represents a trust attribute vector compared in a preset level order. The trust attribute vector includes at least three components: data source trust level, execution subject trust level, and destination trust level.

[0014] Furthermore, after obtaining the declared capability set Pdecl, authorized capability set Pperm, implemented capability set Pimpl, and observed capability set Pobs, a consistency judgment is performed: when a capability tuple exists in the implemented capability set Pimpl but not in the declared capability set Pdecl, and there is a reachable implementation path under the preset execution configuration and input constraints, it is marked as a hidden implemented capability; when a capability tuple exists in the observed capability set Pobs but not in the authorized capability set Pperm, and there is no valid user approval, host policy, or legitimate delegation record, it is marked as an unauthorized execution capability; when a capability tuple exists in the declared capability set Pdecl but there is no reachable implementation path under the preset execution configuration and input constraints, it is marked as a declaration-implementation missing capability; when the implemented capability set Pimpl, the observed capability set Pobs, and the authorized capability set Pperm are inconsistent in resource scope, operation destination, or triggering conditions, it is marked as a boundary deviation; the consistency judgment result is used as detection evidence in the detection result output, and is not used alone as a verified threat chain conclusion.

[0015] Furthermore, the cross-skill edges in the cross-skill behavior graph include one or more of the following: shared resource edges, data handover edges, capability delegation edges, context transfer edges, trust transfer edges, and operational trajectory edges; each cross-skill edge is associated with one or more of the following: resource identifier, data artifact identifier, calling subject, called subject, permission scope, trust boundary, relationship source, and relationship confidence; the shared resource edges confirm the same resource represented by different resource identifiers through resource identity determination, and the resource identity determination adopts a dynamic adaptive threshold mechanism based on resource type, with different types of resources configured with benchmark thresholds, and the benchmark thresholds are dynamically calibrated according to the complexity of alias resolution in the current environment.

[0016] Furthermore, the calculation of the difference set Δπ includes determining one by one whether the combined capability tuples in the actual capability path are covered by the authorized capability path: if and only if there exists an authorized tuple in the authorized capability path that has the same normalized subject chain or valid legal delegation relationship as the combined capability tuple, and its input resources, output resources, and resource scope respectively cover the input resources, output resources, and scope of the combined capability tuple, its authorized operation sequence covers the operation sequence and sequential constraints of the combined capability tuple, its operation destination covers the operation destination of the combined capability tuple, the triggering condition of the combined capability tuple is implied in the triggering condition allowed by the authorized tuple, and the trust attribute of the combined capability tuple is not lower than the trust level required by the authorized tuple in terms of data source, execution subject, and destination, then the combined capability tuple is determined to be covered; the combined capability tuples that are not covered are added to the difference set Δπ.

[0017] Furthermore, the taint source includes at least one of sensitive resources, sensitive credentials, sensitive context, and untrusted input; the hazard sink includes at least one of external transmission, dynamic execution, system commands, high-risk tool calls, and unauthorized state changes; the taint label also propagates along at least one of context propagation edges and runtime trajectory edges; taint labels are retained and recorded as data transformation nodes for encoding, compression, decoding, serialization, digest, format conversion, and intermediate file saving nodes; the taint propagation adopts a taint confidence decay mechanism: defining semantic retention coefficients for different transformation types, multiplying the taint confidence along the propagation path by the semantic retention coefficients of each data transformation node, and when the taint confidence drops below a preset decay threshold, the taint label is downgraded to a low-confidence trace and its decay path is recorded. The low-confidence trace is not used as a separate basis for threat chain determination but participates in risk scoring as auxiliary evidence.

[0018] Furthermore, it also includes execution capability primitive path matching on the cross-skill behavior graph, the matched path patterns including one or more of the following: data leakage path, remote execution path, access scope breach path, result tampering path, and conditional latent path; and split load identification: when the individual risk score of each skill traversed by the threat chain is lower than the individual threshold, while the combined risk score of the threat chain is higher than the combined threshold, and the calculation of the combined risk score includes at least cross-skill boundaries, authorization differences, and taint source to hazard sink propagation relationship, the threat chain is marked as a split load type threat chain, and the combined threshold is greater than the individual threshold.

[0019] Furthermore, it also includes trigger condition generation and dynamic verification: extracting candidate trigger conditions from conditional branches, input validation, environment reading, context judgment, time state judgment, and conditional activation edges; generating targeted verification input based on the candidate trigger conditions, threat chain input nodes, and cross-skill data handover relationships; executing the skill combination in an isolated sandbox to obtain skill call order, tool call parameters, file access, network connection, data artifact transfer, context read / write, and hazard sink state changes; converting the dynamic execution results into an observation capability set and verifying it against the actual capability path Cπ and the authorized capability path Aπ; when the dynamic trajectory meets the following two conditions, the threat chain is confirmed as a verified threat chain: The first type of condition is that at least one of the skill path and the hazard sink is consistent with the static threat chain. The second type of condition is that at least one of the data flow from the sensitive source to the hazard sink and the difference in the authorization boundary is consistent with the static threat chain, and the dynamic data artifacts, calling parameters, or resource evidence can be associated with the static threat chain. When the static threat chain is not dynamically triggered, it is marked as a potential threat chain, the unmet triggering conditions or unreachable nodes are recorded, and verification inputs are generated based on the records for iterative verification. The iterative verification is set with termination conditions: it is forcibly terminated when the maximum number of iterations reaches a preset limit or the number of newly added triggerable evidences in a consecutive predetermined number of iterations. After termination, potential threat chains that have not yet been triggered are graded and output according to their static risk scores.

[0020] Furthermore, it also includes: calculating a normalized combined risk score and outputting the risk level based on one or more of the following: sensitivity source level, hazard sink level, number of skill boundaries crossed, degree of difference between actual capability path and authorized capability path, the hidden implementation capability, the operational overreach capability, split load attribute, conditional latent attribute, trust transfer attribute, and degree of dynamic state change; the combined risk score Rπ is calculated according to the following formula:

[0021] Rπ=w1·Ssrc+w2·Shub+w3·Bπ+w4·Dπ+w5·Tπ+w6·Vπ

[0022] Wherein, Ssrc is the sensitivity source level, normalized to [0,1] according to the preset sensitivity source classification table; Shub is the hazard sink level, normalized to [0,1] according to the preset hazard sink classification table; Bπ is the boundary crossing degree; Dπ is the authorization difference degree; Tπ is the concealment factor; Vπ is the dynamic hazard degree; w1 to w6 are preset weights, each weight is ≥0 and the sum is 1;

[0023] The boundary span Bπ is calculated according to the following formula:

[0024] Bπ=min(1,(n_skill−1+n_trust+n_scope) / B_max)

[0025] Wherein, n_skill is the number of skills traversed by the threat chain, n_trust is the number of trust boundaries crossed by the threat chain, n_scope is the number of times resource scope expansion occurs in the threat chain, and B_max is the pre-configured theoretical maximum normalization constant.

[0026] The authorization difference degree Dπ is calculated according to the following formula:

[0027] Dπ = |Δπ| / max(1, |Cπ|)

[0028] Where |Δπ| represents the number of capability tuples in the difference set, and |Cπ| represents the total number of capability tuples in the actual capability path;

[0029] The concealment factor Tπ is calculated according to the following formula:

[0030] Tπ = α1·I (conditional latency) + α2·I (split load) + α3·I (trust transfer)

[0031] Where I(·) is the indicator function, α1, α2, and α3 are preset sub-weights, and α1+α2+α3=1; the concealment factor Tπ also includes a weighted correction term T_trace=γ×(number of low-confidence traces / total number of transformation nodes), where the number of low-confidence traces is the number of taint markers whose taint confidence drops below a preset attenuation threshold, the total number of transformation nodes is the total number of data transformation nodes on the taint propagation path, γ is a preset correction coefficient, and the updated concealment factor Tπ'=min(1,Tπ+T_trace);

[0032] The dynamic hazard level Vπ is calculated according to the following formula:

[0033] Vπ = (Sum of hazards that occur during dynamic verification) / (Total number of hazards)

[0034] When the combined risk score Rπ reaches the high risk threshold, a high risk conclusion is output; when it reaches the medium risk threshold but not the high risk threshold, a medium risk conclusion is output; otherwise, a low risk or unverified conclusion is output.

[0035] And generate an evidence chain for each risk conclusion, wherein the evidence chain records one or more of the following: relevant skill identifier, version, source, capability set at each layer, threat chain node, cross-skill edge, sensitive source, data artifact, data transformation node, hazard sink, actual capability path, authorized capability path, difference set, triggering condition, verification input, and dynamic execution trajectory.

[0036] Furthermore, it also includes version difference retesting: saving the declared capabilities, authorized capabilities, implementation capabilities, observation capabilities, and cross-skill behavior graphs of the current skill set as a baseline; when any skill is updated to a new version, comparing the differences between the multi-layered skill security representation and cross-skill behavior graphs of the old and new versions to obtain one or more differences among additions, deletions, modifications, replacements, changes in trigger conditions, changes in authorized scope, changes in relationship evidence, and changes in dependencies; calculating the affected path closure based on the difference nodes and difference edges; repeating the steps of calculating the actual capability path and authorized capability path, determining cross-skill combination capability out of bounds, generating cross-skill threat chains, and performing risk assessment and evidence chain generation only for the affected paths, and updating the baseline after associating the detection results with the old version detection results; the calculation of the affected path closure includes the union of explicit graph change paths and implicit data surface dependency paths: identifying the types of shared resources that the changed skill can write at runtime, retrieving all other skills in the baseline that read or consume the shared resources, and incorporating the implicit dependency relationships formed between the other skills and the changed skill through shared resources into the affected path closure.

[0037] Compared with the prior art, the present invention has the following beneficial effects:

[0038] This invention constructs structured capability tuples by collecting information from four layers of intelligent agent skill declaration permissions, implementation, and operation. It integrates cross-skill behavior graphs, combining upstream and downstream capabilities segment by segment along resource transfer and invocation relationships to form actual capability paths. These paths are then compared element-by-element with authorized capability paths generated according to authorization policies, based on the main resource operation sequence, destination trigger conditions, and trust attribute vectors. Unauthorized combined capability tuples are detected to determine cross-skill combined capability overreach. Based on this, cross-skill taint propagation and capability primitive path matching are performed to identify and split payload-type threat chains. Combined with trigger conditions, an isolation sandbox dynamic verification and static-dynamic check mechanism are used to reduce false alarms and confirm real risks. Finally, a normalized risk level and a traceable evidence chain are output, supporting incremental retesting based on version differences of affected path closures. This invention effectively detects cross-skill composite data leakage and authorization boundary overreach behaviors that cannot be identified by single-skill detection, improving the comprehensiveness, accuracy, and verifiability of intelligent agent supply chain security detection, while significantly reducing the retesting cost of large-scale skill sets. Attached Figure Description

[0039] Figure 1 This is a flowchart illustrating the steps of an embodiment of the intelligent agent skill poisoning detection method based on cross-skill flow and authorization boundary according to the present invention.

[0040] Figure 2 This diagram illustrates the four-layer skill security representation, capability tuple structure, and declaration-implementation-run alignment rules of an embodiment of an intelligent agent skill poisoning detection method based on cross-skill flow and authorization boundary according to the present invention.

[0041] Figure 3 This is a schematic diagram of the skill object graph and cross-skill behavior graph structure of an embodiment of the intelligent agent skill poisoning detection method based on cross-skill flow and authorization boundary of the present invention.

[0042] Figure 4 This diagram illustrates the taint propagation, data transformation node labeling, and single / combined threshold determination of a cross-skill sensitive data leakage threat chain, based on an embodiment of an intelligent agent skill poisoning detection method according to cross-skill flow and authorization boundary of the present invention.

[0043] Figure 5 This is a schematic diagram of the trigger condition generation, sandbox verification, static-dynamic verification, and iterative verification loop of an embodiment of the intelligent agent skill poisoning detection method based on cross-skill flow and authorization boundary of the present invention. Detailed Implementation

[0044] The present invention will be further described in detail below through specific embodiments:

[0045] The specific implementation process is as follows:

[0046] Example 1

[0047] Example 1 is attached. Figure 1 As shown, an agent skill poisoning detection method based on cross-skill flow and authorization boundary includes:

[0048] Obtain the set of skills to be detected, collect the declaration information, permission information, implementation information and operation information of each skill in the set, establish skill security representations at the declaration layer, permission layer, implementation layer and operation layer respectively, and construct a skill object graph;

[0049] The capability information in the four-layer skill security representation is converted into a structured capability tuple c=(u,r,o,s,d,t,q), where u represents the normalized capability subject and delegation chain, r represents the resource pair r=(r_in,r_out) consisting of input and output resources, o represents the operation sequence arranged in the order of execution, s represents the resource scope, d represents the operation destination, t represents the triggering condition, and q represents the trust attribute vector compared in a preset level order. The declared capability set Pdecl, the authorized capability set Pperm, the implementation capability set Pimpl, and the observation capability set Pobs are obtained respectively. The trust attribute vector includes at least three components: data source trust level, execution subject trust level, and destination trust level.

[0050] Merge the skill object graphs of each skill, and construct a cross-skill behavior graph based on at least one of the following: resource access relationship, data artifact transfer relationship, skill invocation relationship, permission delegation relationship, context transfer relationship, trust evaluation transfer relationship, and continuous execution invocation relationship between different skills.

[0051] For the candidate skill call path π in the cross-skill behavior graph, only adjacent capability tuples with cross-skill edges and input / output resource association evidence are combined to obtain the actual capability path Cπ. The input resources of the combined capability tuple are taken from upstream input resources, the output resources are taken from downstream output resources, the operation sequence maintains the execution order, the triggering condition is the conjunction of upstream and downstream triggering conditions, and three-valued logic is used for satisfiability determination. When the output result is unknown, the combined capability tuple is retained and a dynamically verified flag is added. The trust attribute is determined by taking the lower level from the three components: data source, execution subject, and destination. An authorized capability path Aπ is generated based on the authorized capability set, host security policy, task authorization scope, user approval scope, and skill delegation constraints.

[0052] Calculate the difference set Δπ = Cπ − Aπ between the actual ability path Cπ and the authorized ability path Aπ; when there is a combination ability tuple that is simultaneously associated with two or more skills in the difference set, it is determined that the skill set has cross-skill combination ability overstepping.

[0053] Specifically, in this embodiment, the set of skills to be detected is used as input. This set of skills contains three skills, denoted as Skill A, Skill B, and Skill C. First, the declaration information, permission information, implementation information, and operational information of each skill in the set are collected. The declaration information includes the skill's name, function description, prompt template, parameter description, input / output description, and usage restrictions; the permission information includes file access scope, credential access scope, network access scope, command execution scope, tool binding scope, skill invocation scope, and context loading scope; the implementation information includes source code, scripts, dependencies, configuration files, tool interfaces, dynamic loading logic, and external resource references; the operational information includes actual tool invocation, file access, network communication, command execution, context writing, cross-skill invocation, and output results.

[0054] As attached Figure 1 As shown, based on the four types of information collected above, skill security representations are established at the declaration layer, permission layer, implementation layer, and runtime layer, respectively. The declaration layer represents the functions that the skill claims to be able to perform and its expected inputs and outputs; the permission layer represents the resources and operational scope that the skill is allowed to use under specified host, task, and user authorization conditions; the implementation layer represents the actual capabilities provided by the code, configuration, dependencies, and tool bindings; and the runtime layer represents the observable behavior of the skill in a sandbox or actual controlled environment.

[0055] Based on this, a skill object graph is constructed for each skill. Node types include declaration nodes, prompt nodes, parameter nodes, interface nodes, tool nodes, permission nodes, resource nodes, dependency nodes, execution nodes, data nodes, context nodes, and output nodes. Edge types include declaration relationship edges, permission constraint edges, tool binding edges, dependency relationship edges, control flow edges, data flow edges, resource access edges, context transitive edges, and output relationship edges. Taking skill A as an example, its declaration node records the description information of "finding the configuration file from the specified project directory," and its implementation node records the code logic that can read the project directory and environment variables. These nodes are associated with each other through declaration relationship edges and implementation relationship edges.

[0056] Subsequently, the capability information in the above four-layer skill security representation is converted into a structured capability tuple c=(u,r,o,s,d,t,q). For each skill, a set of declared capabilities Pdecl, a set of authorized capabilities Pperm, a set of implemented capabilities Pimpl, and a set of observed capabilities Pobs are generated respectively.

[0057] In a specific example, skill A's declared capability set Pdecl contains a capability tuple called "Project File Retrieval," with resource pairs of (project directory, file list), operation sequence of "enumerate directories," and destination of the local file system. However, its implemented capability set Pimpl, in addition to the above capability, also contains a capability tuple called "Environment Variable Reading," whose input resource is the environment variable storage area, and output resource is the environment variable value. This "Environment Variable Reading" capability has a reachable implementation path under the preset execution configuration and input constraints, and is therefore marked as a hidden implementation capability. Skill C's declared capability set Pdecl contains a capability tuple called "Submit Processing Results to a Specified Service," with its destination being an internal service address; its authorized capability set Pperm also only allows internal service addresses; however, its observed capability set Pobs records the behavior of initiating a network connection to an external address, and this behavior has no corresponding user approval record or legitimate delegation record, and is therefore marked as running an unauthorized capability.

[0058] In this process, capability extraction employs two paths: deterministic extraction and semantic extraction. The deterministic extraction path acquires capabilities by performing abstract syntax tree parsing, control flow analysis, call relationship analysis, and data flow analysis on the source code, as well as pattern validation and permission field parsing on the manifest file and structured configuration. The semantic extraction path performs capability semantic recognition on description text, prompt templates, parameter descriptions, and code snippets, and performs structured parsing of resources, operations, destinations, and triggering conditions in natural language. Before semantic extraction, the input text undergoes character unification, homograph normalization, and injection tagging to eliminate interference from visually similar characters (such as homographs of Cyrillic and Latin letters) and prompt injection tags on the semantic recognition results. For each candidate capability, if it is hit by both the deterministic and semantic extraction paths, or passes secondary confirmation through code data flow, configuration constraints, or dynamic trajectory, it is marked as a high-confidence capability; if it is extracted by only a single path and fails secondary confirmation, it is marked as a low-confidence capability. Low-confidence candidate capabilities are not directly used as risk conclusions, but only as supplementary evidence in risk scoring for subsequent steps. The results extracted from the two paths are normalized and mapped to a unified set of capability primitives, which includes primitives for file reading, file writing, credential reading, environment variable reading, directory enumeration, data encoding, data compression, data serialization, network sending, network receiving, command execution, dynamic loading, tool invocation, context writing, permission granting, and skill delegation.

[0059] Next, as attached Figure 3 As shown, the skill object graphs of each skill are merged, and a cross-skill behavior graph is constructed based on the interaction relationships between different skills. These interaction relationships include resource access relationships, data artifact transfer relationships, skill invocation relationships, permission delegation relationships, context transfer relationships, trust evaluation transfer relationships, and continuous execution invocation relationships. The cross-skill edges in the cross-skill behavior graph include shared resource edges, data exchange edges, capability delegation edges, context transfer edges, trust transfer edges, and execution trajectory edges.

[0060] In this specific example, skill A writes the read file content to a temporary file during execution. This temporary file is then read by skill B as input, thus establishing a data exchange edge between skill A and skill B. After completing the encoding operation, skill B passes the encoding result as a parameter to the network request of skill C, thus establishing a data exchange edge and parameter binding relationship between skill B and skill C. Simultaneously, an execution trajectory edge is also established between skill A and skill B, as the execution records show a continuous call relationship between the two skills. Each cross-skill edge is associated with corresponding relationship evidence, including resource identifier, data artifact identifier, calling subject, called subject, permission scope, trust boundary, relationship source, and relationship confidence.

[0061] For shared resource edges, when different skills access the same resource but the resource identifiers are inconsistent, evidence of resource identity is obtained through methods such as path normalization, symbolic link resolution, file content summarization, variable constraint analysis, resource alias resolution, artifact source tracing, or runtime trajectory. For example, skill A accesses a configuration file via the relative path ". / config / app.conf", and skill B accesses the same file via the absolute path " / home / user / project / config / app.conf". The system confirms that both point to the same resource through path normalization and symbolic link resolution. When the relationship confidence reaches a preset threshold, they are confirmed as the same resource. The relationship confidence threshold here adopts a dynamic adaptive mechanism based on resource type. The baseline threshold for file path type resources is set to 0.85. When the average symbolic link depth is 2 layers and the preset maximum depth is 4 layers, the threshold is dynamically calibrated to 0.85×(1+2 / 4×0.5)=0.925 based on the complexity of environment alias resolution.

[0062] Based on this, the actual capability path is calculated for candidate skill invocation paths in the cross-skill behavior graph. Taking the candidate invocation path π=(Skill A, Skill B, Skill C) as an example, the system only selects capability tuples with evidence of association with nodes and edges on this path, and combines them based on data handover edges, capability delegation edges, and operation trajectory edges. Adjacent capability tuples are combined only when there is a corresponding cross-skill edge, and the output resource or output artifact of the upstream tuple and the input resource or input artifact of the downstream tuple satisfy resource identity, data type compatibility, or parameter binding relationship. The combination process adopts a round-by-round expansion approach, that is, the combination result of skill A and skill B continues to be combined with the capability tuple of skill C, thereby supporting chained combinations of more than three skills.

[0063] In a specific combination, the output artifact of the "file reading" capability tuple of skill A and the input artifact of the "encoding processing" capability tuple of skill B satisfy resource identity. Their combination yields an intermediate combined capability tuple. Its input resource is the sensitive file in the project directory (the input resource of skill A), and its output resource is the encoded data artifact (the output resource of skill B). The operation sequence is "read → encode," and the trigger condition is the conjunction of the trigger conditions of skill A and skill B. The trust attribute is determined by taking the lowest level from each of the three components: data source, executor, and destination. This intermediate combined capability tuple is then combined with the "network sending" capability tuple of skill C. The output of skill B (the encoded data artifact) and the input of skill C (the request parameters) satisfy parameter binding. Finally, a complete combined capability tuple is obtained. Its input resource is still the sensitive file in the project directory, and its output resource is an external network request. The operation sequence is "read → encode → send," the destination is an external address, the trigger condition is the conjunction of the trigger conditions of the three skills, and the trust attribute is the trust vector obtained by taking the lowest level from each of the three components.

[0064] During the conjunction of triggering conditions, the system uses ternary logic to determine satisfiability. When the constraint solver outputs a satisfiable result, the combination is retained normally; when the output is unsatisfiable, the combination is discarded; when the output is unknown, i.e., when the triggering condition involves runtime factors such as external time state, third-party API return values, or random numbers and cannot be statically determined, the system retains the capability tuple of the combination and adds a dynamic verification flag to it. This ensures that the combination path enters the subsequent sandbox verification stage where the actual execution determines whether it can be triggered, avoiding the erroneous rejection of valid attack paths due to undeterminability in static analysis.

[0065] Simultaneously, the system generates an authorization capability path Aπ based on the authorization capability set Pperm, host security policy, task authorization scope, user approval scope, and skill delegation constraints. During authorization path generation, each authorization source is converted into an authorization tuple. Constraints are applied to resources, scope, destination, triggering conditions, and trust requirements according to the host security policy, task authorization scope, and user approval scope. Only adjacent path segments with valid delegation chains and valid authorization records are connected. Conflicting authorizations on the same candidate path are subject to restrictive constraints. The authorization capability path retains the source, validity period, scope, destination, triggering conditions, and trust requirements for each authorization segment, and does not directly merge independent permissions of different skills into an unlimited combination of permissions.

[0066] Subsequently, the difference set Δπ = Cπ − Aπ between the actual capability path Cπ and the authorized capability path Aπ is calculated. The difference set is calculated by checking whether each combined capability tuple in the actual capability path is covered by at least one authorized tuple in the authorized capability path. Coverage determination uses a factor-by-factor comparison: an authorized tuple in the authorized capability path is considered covered if and only if it has the same normalized subject chain or valid legitimate delegation relationship as the combined capability tuple to be determined, its input resources, output resources, and resource scope cover the input resources, output resources, and scope of the combined capability tuple, its authorized operation sequence covers the operation sequence and sequential constraints of the combined capability tuple, its operation destination covers the operation destination of the combined capability tuple, the triggering conditions of the combined capability tuple are implied in the triggering conditions allowed by the authorized tuple, and the trust attribute of the combined capability tuple, in terms of data source, executing subject, and destination, is not lower than the trust level required by the authorized tuple. Uncovered combined capability tuples are added to the difference set.

[0067] In this example, the aforementioned complete combined capability tuple composed of skills A, B, and C has an operation destination of an external address. However, the authorized capability path only contains authorized tuples that send data to internal service addresses, thus failing to meet the destination coverage condition. Simultaneously, its trust attribute vector shows that the path crosses a trust boundary, while the authorized tuple requires a higher trust level, meaning the trust attribute component condition is also not met. Although this combined capability tuple matches an authorized tuple in terms of the subject chain, resource pair, and scope, it is not covered in terms of both destination and trust attribute, and therefore is added to the difference set Δπ. This combined capability tuple is associated with three skills: A, B, and C, satisfying the judgment condition for cross-skill combined capability boundary crossing. In this embodiment, it is further confirmed that this combined capability tuple crosses the boundary of the resource scope from the project directory to the external network, and the operation destination is an external address while the authorized path only allows internal service addresses; the trust attribute vector crosses the trust boundary while the authorized tuple requires a higher trust level. Therefore, the system determines that this skill set has a cross-skill combined capability boundary crossing.

[0068] On the cross-skill behavior graph, the system also performs cross-skill threat chain identification. First, it performs capability primitive path matching, matching path patterns including data leakage paths, remote execution paths, access scope breaching paths, result tampering paths, and conditional latent paths. Specifically, a data leakage path refers to a path where sensitive file reading, credential reading, or environment variable reading capabilities, after data processing, encoding, compression, or serialization, reach external networks, messages, emails, or untrusted services; a remote execution path refers to a path where external input, network data, or untrusted tool results, after file writing, script generation, or parameter concatenation, reach dynamic execution or system command nodes; an access scope breaching path refers to a path where resource discovery, directory traversal, or permission acquisition capabilities, after call delegation or context passing, reach read / write nodes beyond the authorized scope; a result tampering path refers to a path where untrusted input, low-confidence audit conclusions, or malicious tool results, after trust transfer or authorization implication, influence high-risk execution decisions; and a conditional latent path refers to a path where one or more nodes in the threat chain are controlled by input, environment, context, time, or state conditions, activating only when specific conditions are met. Simultaneously, cross-skill taint propagation is performed: sensitive resources, sensitive credentials, sensitive contexts, and untrusted inputs are marked as taint sources, while external transmissions, dynamic executions, system commands, high-risk tool calls, and unauthorized state changes are marked as dangerous sinks. Taint labels propagate along intra-skill data flow edges, cross-skill data handover edges, context transfer edges, and runtime trajectory edges. Taint labels are retained and recorded as data transformation nodes such as encoding, compression, decoding, serialization, digestion, format conversion, and intermediate file saving.

[0069] During taint propagation, the system employs a taint confidence decay mechanism. Specifically, semantic retention coefficients are defined for different transformation types: 1.0 for lossless encoding and format conversion, 0.8 for lossless compression, 0.2 for lossy compression and cryptographic hashing, and 0.1 for aggregate statistics. The taint confidence is multiplied by the semantic retention coefficients of each data transformation node along the propagation path. In this example, a sensitive file is marked as a taint source and assigned a taint label, with an initial taint confidence of 1.0. This taint propagates along data transformation nodes such as file reading, intermediate artifact writing, and encoding / compression. The semantic retention coefficient of the encoding / compression node is 0.8. Assuming the propagation path also passes through a format conversion node with a semantic retention coefficient of 1.0, the taint confidence is 1.0 × 0.8 × 1.0 = 0.8, which is still higher than the preset decay threshold of 0.3, and the taint label is retained normally. If the taint passes through further hash calculation nodes, the taint confidence level drops further to 0.8 × 0.2 = 0.16, which is below the preset decay threshold. The taint is then downgraded to a low-confidence trace, and its decay path is recorded. Low-confidence traces are not used as the sole basis for threat chain determination, but they serve as supplementary evidence in subsequent risk scoring.

[0070] The taint propagation algorithm is implemented using a worksheet: all taint sources are initialized as a set of worksheets. Each time, a node is retrieved from the worksheet, and its taint label is propagated to downstream nodes along its outgoing edges (data flow edges, data handover edges, context passing edges, or trajectory edges). If a downstream node obtains a new taint label, it is added to the worksheet to continue propagation until the worksheet is empty. After propagation, for each hazard sink with a taint label, the propagation path is traced back to the taint source along the propagation edges to obtain the complete taint propagation path. The taint propagation path is converted into a normalized capability tuple set Φ(p) with the same format as the difference set Δπ through a normalized mapping. Then, the intersection of Δπ and Φ(p) is determined, avoiding direct intersection of the capability tuple set and the capability primitive set. When a taint propagates from a taint source to a hazard sink, the propagation path crosses at least one skill boundary, and Δπ and Φ(p) have a capability tuple intersection, a cross-skill threat chain is generated. In this example, the taint originates from a sensitive file in the project directory, passes through file reading by skill A, encoding and compression by skill B, and network transmission by skill C, and finally reaches the dangerous sink of the external network. The propagation path crosses the skill boundaries of skill A to skill B and skill B to skill C, and the combined capability tuple corresponding to this propagation path already exists in the difference set Δπ. Therefore, the system generates a cross-skill sensitive data leakage threat chain.

[0071] As attached Figure 4As shown, load splitting identification is performed based on this. The individual risk scores of skills A, B, and C are calculated separately. The individual risk score of skill A is 0.25, skill B is 0.20, and skill C is 0.30, all of which are lower than the preset individual threshold of 0.4. However, the combined risk score of this threat chain is 0.83, which is higher than the preset combined threshold of 0.6. Moreover, the calculation of the combined risk score includes cross-skill boundaries, authorization differences, and the propagation relationship from taint source to hazard sink. Therefore, the system marks this threat chain as a load splitting threat chain.

[0072] Next, trigger condition generation and dynamic verification are performed. (See attached...) Figure 5 As shown, the system extracts candidate triggering conditions from conditional branches, input validation, environment reading, context judgment, time status judgment, and conditional activation edges. In this example, the code for skill B contains conditional judgment statements, which only execute the sending operation of the encoded result when the input parameter contains a specific string and the environment variable meets the preset conditions. Based on this, the system generates targeted validation input, including task text containing a specific string and environment variable values ​​that meet the preset conditions. The combination of skills A, B, and C is executed in an isolated sandbox. The sandbox is configured with monitoring of configuration files and credential access, network connection and destination, tool invocation and parameter monitoring, context read / write monitoring, and dangerous sink state change monitoring. During execution, the system records the skill invocation order, tool invocation parameters, file access, network connection, data artifact transfer, context read / write, and dangerous sink state changes.

[0073] The dynamic execution results are converted into an observation capability set and compared with the statically calculated actual capability path Cπ and authorized capability path Aπ. The dynamic trajectory shows that the skill path is Skill A → Skill B → Skill C, the hazard sink is sent from an external network, consistent with the static threat chain, satisfying the first type of verification condition; sensitive files flow from the project directory through Skill A and Skill B to the external network connection of Skill C, this data flow direction is consistent with the authorized boundary difference, and the intermediate artifact summaries recorded in the sandbox can be associated with the data artifact evidence in the static threat chain, satisfying the second type of verification condition. If both conditions are met, the system confirms the threat chain as a verified threat chain. If a candidate path is not triggered during sandbox execution, i.e., some nodes in the static threat chain fail to reach the hazard sink due to unmet triggering conditions, the path is marked as a potential threat chain, the unmet triggering conditions or unreachable nodes are recorded, and verification input is generated based on the records for iterative verification. Iterative verification has a clear termination condition: forced termination occurs when the maximum number of iterations reaches a preset limit of 3, or when the number of newly added triggerable evidence is zero in two consecutive iterations. After termination, for potential threat chains that have not yet been triggered, if their static combined risk score is higher than the medium risk threshold of 0.4, the output will be "awaiting manual review" with static evidence and previous verification input records attached; if it is lower than the medium risk threshold, it will be downgraded to a low risk conclusion and archived.

[0074] The risk assessment phase then begins. The portfolio risk score Rπ is calculated using the following formula:

[0075] Rπ=w1·Ssrc+w2·Shub+w3·Bπ+w4·Dπ+w5·Tπ+w6·Vπ

[0076] The weights are w1=0.20, w2=0.20, w3=0.15, w4=0.20, w5=0.10, and w6=0.15.

[0077] The values ​​for each component are as follows: Sensitive source refers to sensitive files in the project directory, and its level Ssrc=0.9 according to the preset sensitive source classification table; Dangerous sink refers to data sent from external networks, and its level Shub=0.8 according to the preset dangerous sink classification table.

[0078] The boundary span Bπ is calculated using the following formula:

[0079] Bπ=min(1,(n_skill−1+n_trust+n_scope) / B_max)

[0080] The threat chain passes through 3 skills (n_skill=3), crosses 1 trust boundary (n_trust=1), and undergoes 1 scope expansion (n_scope=1). B_max is set to the default value of 5. Substituting these values, we get Bπ=min(1,(3−1+1+1) / 5)=min(1,4 / 5)=0.8.

[0081] The authorization difference degree Dπ is calculated according to the following formula:

[0082] Dπ = |Δπ| / max(1, |Cπ|)

[0083] The total number of combined capability tuples in the actual capability path is 5, and the number of uncovered capability tuples in the difference set is 3. Substituting these values, we get Dπ = 3 / 5 = 0.6.

[0084] The concealment factor Tπ is calculated according to the following formula:

[0085] Tπ = α1·I (conditional latency) + α2·I (split load) + α3·I (trust transfer)

[0086] Taking α1=0.5, α2=0.5, and α3=0, this threat chain possesses both conditional latency and split load attributes. Therefore, I(conditional latency)=1, I(split load)=1, and I(trust transfer)=0. Substituting these values, we get Tπ=0.5×1+0.5×1+0=1.0. Furthermore, the weighted correction term T_trace for low-confidence taint traces is calculated using the following formula:

[0087] T_trace = γ × (Number of low-confidence traces / Total number of transformation nodes)

[0088] With γ=0.2, the number of low-confidence traces in the threat chain is 0, and the total number of transformation nodes is 2. Therefore, T_trace=0, and the updated concealment factor Tπ'=min(1,Tπ+T_trace)=1.0.

[0089] The dynamic hazard level Vπ is calculated using the following formula:

[0090] Vπ = (Sum of hazards that occur during dynamic verification) / (Total number of hazards)

[0091] In the dynamic verification, both dangerous sinks undergo actual state changes, therefore Vπ = 2 / 2 = 1.0.

[0092] Substitute the above components into the portfolio risk score formula:

[0093] Rπ=0.20×0.9+0.20×0.8+0.15×0.8+0.20×0.6+0.10×1.0+0.15×1.0

[0094] Rπ=0.18+0.16+0.12+0.12+0.10+0.15=0.83

[0095] The preset high-risk threshold is 0.7, the medium-risk threshold is 0.4, and Rπ=0.83 reaches the high-risk threshold, at which point the system outputs a high-risk conclusion. Simultaneously, an evidence chain is generated for each risk conclusion, recording the relevant skill identifier, version, and source; the capability sets at each layer; the nodes and edges traversed by the threat chain; sensitive sources, data artifacts, data transformation nodes, and hazard sinks; the actual capability path Cπ, the authorized capability path Aπ, and the difference set Δπ; cross-skill relationship evidence and permission boundary evidence; triggering conditions, verification inputs, and sandbox operation trajectory; as well as the risk score composition and risk level.

[0096] When any skill in the skill set undergoes a version update, the system performs a version difference retest. The declared capabilities, authorized capabilities, implemented capabilities, observation capabilities, and cross-skill behavior graph of the current skill set are saved as a baseline. When skill B is updated to the new version, the difference comparison engine compares the differences between the old and new versions of the skill security representations at each layer and the cross-skill behavior graph. It discovers that the new version includes changes such as external network tool binding, dynamic loading logic, and an expansion of the destination range from internal to external addresses, resulting in an incremental set containing both added and modified types. The affected path closure is calculated based on the difference nodes and difference edges.

[0097] The calculation of the affected path closure includes the union of explicit graph change paths and implicit data surface dependency paths: identifying the types of shared resources that skill B can write at runtime, retrieving all other skills in the baseline that read or consume these shared resources, and incorporating the implicit dependencies between these skills and the changed skill formed through shared resources into the closure. In this example, skill B writes a new shared configuration file, and skill C reads the network address parameters in this configuration file at runtime. Although there is no direct edge connection between skill B and skill C in the static graph, an implicit data surface dependency is formed through this shared configuration file, and this dependency is included in the affected closure. The system only re-executes the aforementioned path combination and boundary judgment, threat chain identification, dynamic verification, and risk assessment detection steps for paths within the scope of this closure. It discovers a new threat chain where sensitive context reading, after dynamic loading, is bound to external transmission through network request parameters. The system performs risk assessment and dynamic verification on this new path, correlates the results with the old version detection results to form version difference evidence, and writes it back to the baseline library.

[0098] Example 2

[0099] Example 2 is a method for detecting agent skill poisoning based on cross-skill flow and authorization boundaries. The only difference between Example 2 and Example 1 is that this example targets trust transfer and authorization implication-based cross-skill risks. The set of skills to be detected includes skill D and skill E. Skill D is a security audit skill, whose declared function is "to perform security audit on the target operation and output audit conclusions." Its implementation code can read the parameters and execution environment of the target operation and output audit conclusions in text form. Skill E is a high-risk execution skill, whose declared function is "to execute the target operation according to the approval result." Its implementation code includes conditional judgment logic: when there are "check passed," "audit passed," or similar positive audit conclusions in the context, the approval requirements are lowered and the target operation is executed directly.

[0100] The system constructs four-layer skill security representations and skill object graphs for skills D and E respectively. During the cross-skill behavior graph construction phase, the system recognizes that the output of skill D (audit conclusion text) enters the context of skill E and affects its execution decision. Therefore, a trust transfer edge is established between skill D and skill E, and the relationship evidence is recorded, including: the calling entity is skill D, the called entity is skill E, the source of the relationship is the correlation analysis between context transmission and execution decision, and the trust boundary is the difference between the trust level of the audit conclusion of skill D and the trust level required for the execution of skill E.

[0101] During the actual capability path calculation phase, the system combines the "audit conclusion output" capability tuple of skill D with the "high-risk execution" capability tuple of skill E along the trust transfer edge, resulting in a combined capability tuple: the subject is the delegation chain D→E, the resource pair is (target operation parameter, execution result), the operation sequence is audit → execution, and the trigger condition is the existence of a positive audit conclusion in the context. During the authorization capability path generation phase, the system confirms that the audit conclusion output of skill D has not received explicit authorization from the user, and the high-risk execution of skill E is only permitted when the user directly approves it, and does not accept audit conclusions from other skills as authorization basis. Therefore, this combined capability tuple is not covered by the authorization tuple in at least one of the normalized subject chain, authorization trigger condition, and destination trust level, and is added to the difference set Δπ.

[0102] During the threat chain identification phase, the system marks untrusted audit conclusions as taint sources and high-risk executions as hazard sinks, propagating the taint labels along trust transfer edges. The taint propagates from the audit conclusion of skill D to the execution decision node of skill E. The propagation path crosses the trust boundary between skill D and skill E, and the corresponding composite capability tuple already exists in the difference set Δπ. Therefore, the system generates a cross-skill trust transfer threat chain and marks this path as an authorization boundary confusion risk.

[0103] In summary, by constructing trust transfer edges and detecting authorization cues, we can identify cross-skill risks that appear normal when checked individually but are combined to form "audit conclusions replacing user authorization." Such risks cannot be detected through single-skill permission verification.

[0104] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A method for detecting agent skill poisoning based on cross-skill flow and authorization boundaries, characterized in that, include: Obtain the set of skills to be detected, collect the declaration information, permission information, implementation information and operation information of each skill in the set, establish a multi-layered skill security representation with declaration layer, permission layer, implementation layer and operation layer respectively, and construct a skill object graph; The capability information in the skill security representation at each layer is converted into structured capability tuples, and the following are obtained: the set of declared capabilities Pdecl, the set of authorized capabilities Pperm, the set of implemented capabilities Pimpl, and the set of observed capabilities Pobs. Merge the skill object graphs of each skill, and construct a cross-skill behavior graph based on the skill relationships between different skills; For the candidate skill call path π, only adjacent capability tuples with evidence of cross-skill edge and input / output resource association are combined to obtain the actual capability path Cπ; the authorized capability path Aπ is generated according to the authorized capability set Pperm and the preset authorization strategy. When the difference set Δπ between the actual ability path Cπ and the authorized ability path Aπ contains an ability tuple that is simultaneously associated with at least two skills, it is determined that the skill set has a cross-skill combination ability overstepping. Sensitive resources and untrusted inputs are marked as tainted sources, and data breach operations and high-risk execution operations are marked as dangerous sinks. The tainted labels are then propagated along the data flow edges and across skill data interfaces. The taint propagation path is converted into a normalized set of capability tuples with the same format as the difference set Δπ. When a taint propagates from a taint source to a hazard sink, the propagation path crosses at least one skill boundary, and the difference set Δπ intersects with the normalized set of capability tuples, a cross-skill threat chain is generated. The existence of the cross-skill threat chain is determined to indicate that the skill set has a skill poisoning behavior, and the detection result is output.

2. The agent skill poisoning detection method based on cross-skill flow and authorization boundary as described in claim 1, characterized in that: The structured capability tuple is represented as c=(u, r, o, s, d, t, q), where u represents the normalized capability subject and delegation chain, r represents a resource pair consisting of input resource r_in and output resource r_out, o represents the operation sequence arranged in the order of execution, s represents the resource scope, d represents the operation destination, t represents the triggering condition, and q represents a trust attribute vector compared in a preset level order. The trust attribute vector includes at least three components: data source trust level, execution subject trust level, and destination trust level.

3. The agent skill poisoning detection method based on cross-skill flow and authorization boundary as described in claim 1, characterized in that: After obtaining the declared capability set Pdecl, authorized capability set Pperm, implementation capability set Pimpl, and observation capability set Pobs, a consistency judgment is performed: when a capability tuple exists in the implementation capability set Pimpl but not in the declared capability set Pdecl, and there is a reachable implementation path under the preset execution configuration and input constraints, it is marked as a hidden implementation capability. When a capability tuple exists in the observation capability set Pobs but not in the authorized capability set Pperm, and there is no valid user approval, host policy, or legitimate delegation record, it is marked as running an unauthorized capability; when a capability tuple exists in the declaration capability set Pdecl but there is no reachable implementation path under the preset execution configuration and input constraints, it is marked as a declaration-implementation missing capability; when the implementation capability set Pimpl, the observation capability set Pobs, and the authorized capability set Pperm are inconsistent in resource scope, operation destination, or triggering conditions, it is marked as a boundary deviation; the consistency judgment result is used as detection evidence in the detection result output, and is not used as a separate conclusion of the verified threat chain.

4. The method for detecting agent skill poisoning based on cross-skill flow and authorization boundary as described in claim 1, characterized in that: The cross-skill edge in the cross-skill behavior graph includes one or more of the following: shared resource edge, data handover edge, capability delegation edge, context transfer edge, trust transfer edge, and operation trajectory edge. Each cross-skill edge is associated with one or more of the following: resource identifier, data artifact identifier, calling subject, called subject, permission scope, trust boundary, relationship source, and relationship confidence. The shared resource edge confirms that different resource identifiers represent the same resource through resource identity determination. The resource identity determination adopts a dynamic adaptive threshold mechanism based on resource type. Different types of resources are configured with benchmark thresholds, and the benchmark thresholds are dynamically calibrated according to the complexity of alias resolution in the current environment.

5. The agent skill poisoning detection method based on cross-skill flow and authorization boundary as described in claim 1, characterized in that: The calculation of the difference set Δπ includes determining one by one whether the combined capability tuples in the actual capability path are covered by the authorized capability path: if and only if there exists an authorized tuple in the authorized capability path that has the same normalized subject chain or valid legal delegation relationship as the combined capability tuple, and its input resources, output resources, and resource scope respectively cover the input resources, output resources, and scope of the combined capability tuple, its authorized operation sequence covers the operation sequence and sequential constraints of the combined capability tuple, its operation destination covers the operation destination of the combined capability tuple, the triggering condition of the combined capability tuple is implied in the triggering condition allowed by the authorized tuple, and the trust attribute of the combined capability tuple is not lower than the trust level required by the authorized tuple in terms of data source, execution subject, and destination, then the combined capability tuple is determined to be covered; the combined capability tuples that are not covered are added to the difference set Δπ.

6. The agent skill poisoning detection method based on cross-skill flow and authorization boundary as described in claim 1, characterized in that: The taint source includes at least one of sensitive resources, sensitive credentials, sensitive context, and untrusted input; the hazard sink includes at least one of external transmission, dynamic execution, system commands, high-risk tool calls, and unauthorized state changes; the taint label also propagates along at least one of context propagation edges and runtime trajectory edges; taint labels are retained and recorded as data transformation nodes for encoding, compression, decoding, serialization, digest, format conversion, and intermediate file saving nodes; the taint propagation adopts a taint confidence decay mechanism: defining semantic retention coefficients for different transformation types, multiplying the taint confidence along the propagation path by the semantic retention coefficients of each data transformation node, and when the taint confidence drops below a preset decay threshold, the taint label is downgraded to a low-confidence trace and its decay path is recorded. The low-confidence trace is not used as a separate basis for threat chain determination but participates in risk scoring as auxiliary evidence.

7. The agent skill poisoning detection method based on cross-skill flow and authorization boundary as described in claim 1, characterized in that: It also includes execution capability primitive path matching on the cross-skill behavior graph, the matched path patterns including one or more of the following: data leakage path, remote execution path, access scope breach path, result tampering path, and conditional latent path; and split load identification: when the individual risk score of each skill traversed by the threat chain is lower than the individual threshold, while the combined risk score of the threat chain is higher than the combined threshold, and the calculation of the combined risk score includes at least cross-skill boundaries, authorization differences, and taint source to hazard sink propagation relationship, the threat chain is marked as a split load type threat chain, and the combined threshold is greater than the individual threshold.

8. The agent skill poisoning detection method based on cross-skill flow and authorization boundary as described in claim 1, characterized in that: It also includes trigger condition generation and dynamic verification: extracting candidate trigger conditions from condition branches, input validation, environment reading, context judgment, time state judgment and condition activation edges; generating targeted verification input based on the candidate trigger conditions, threat chain input nodes and cross-skill data handover relationships; Execute the skill set in an isolated sandbox to obtain the skill call sequence, tool call parameters, file access, network connection, data artifact transfer, context read / write, and hazard sink status changes; convert the dynamic execution results into an observation capability set and verify them against the actual capability path Cπ and the authorized capability path Aπ; when the dynamic trajectory meets the following two conditions, the threat chain is confirmed as a verified threat chain: the first condition is that at least one of the skill path and the hazard sink is consistent with the static threat chain; the second condition is that at least one of the data flow direction from the sensitive source to the hazard sink and the difference from the authorized boundary is consistent with the static threat chain, and the dynamic data artifacts, call parameters, or resource evidence can be associated with the static threat chain; when the static threat chain is not dynamically triggered, it is marked as a potential threat chain, the unmet trigger conditions or unreachable nodes are recorded, and verification input is generated based on the records for iterative verification; the iterative verification is set with termination conditions: the maximum number of iterations reaches a preset limit or the number of newly added triggerable evidence in a predetermined number of consecutive iterations is forcibly terminated, and after termination, potential threat chains that have not yet been triggered are graded and output according to their static risk scores.

9. The agent skill poisoning detection method based on cross-skill flow and authorization boundary as described in claim 3, characterized in that, Also includes: Based on one or more of the following: sensitivity source level, hazard sink level, number of skill boundaries crossed, degree of difference between actual capability path and authorized capability path, hidden implementation capability, operational overreach capability, split load attribute, conditional latent attribute, trust transfer attribute, and degree of dynamic state change, calculate a normalized combined risk score and output the risk level. The portfolio risk score Rπ is calculated using the following formula: Rπ=w1·Ssrc+w2·Shub+w3·Bπ+w4·Dπ+w5·Tπ+w6·Vπ Wherein, Ssrc is the sensitivity source level, normalized to [0,1] according to the preset sensitivity source classification table; Shub is the hazard sink level, normalized to [0,1] according to the preset hazard sink classification table; Bπ is the boundary crossing degree; Dπ is the authorization difference degree; Tπ is the concealment factor; Vπ is the dynamic hazard degree; w1 to w6 are preset weights, each weight is ≥0 and the sum is 1; The boundary span Bπ is calculated according to the following formula: Bπ=min(1,(n_skill−1+n_trust+n_scope) / B_max) Wherein, n_skill is the number of skills traversed by the threat chain, n_trust is the number of trust boundaries crossed by the threat chain, n_scope is the number of times resource scope expansion occurs in the threat chain, and B_max is the pre-configured theoretical maximum normalization constant. The authorization difference degree Dπ is calculated according to the following formula: Dπ = |Δπ| / max(1, |Cπ|) Where |Δπ| represents the number of capability tuples in the difference set, and |Cπ| represents the total number of capability tuples in the actual capability path; The concealment factor Tπ is calculated according to the following formula: Tπ = α1·I (conditional latency) + α2·I (split load) + α3·I (trust transfer) Where I(·) is the indicator function, α1, α2, and α3 are preset sub-weights, and α1+α2+α3=1; the concealment factor Tπ also includes a weighted correction term T_trace=γ×(number of low-confidence traces / total number of transformation nodes), where the number of low-confidence traces is the number of taint markers whose taint confidence drops below a preset attenuation threshold, the total number of transformation nodes is the total number of data transformation nodes on the taint propagation path, γ is a preset correction coefficient, and the updated concealment factor Tπ'=min(1,Tπ+T_trace); The dynamic hazard level Vπ is calculated according to the following formula: Vπ = (Sum of hazards that occur during dynamic verification) / (Total number of hazards) When the combined risk score Rπ reaches the high risk threshold, a high risk conclusion is output; when it reaches the medium risk threshold but not the high risk threshold, a medium risk conclusion is output; otherwise, a low risk or unverified conclusion is output. And generate an evidence chain for each risk conclusion, wherein the evidence chain records one or more of the following: relevant skill identifier, version, source, capability set at each layer, threat chain node, cross-skill edge, sensitive source, data artifact, data transformation node, hazard sink, actual capability path, authorized capability path, difference set, triggering condition, verification input, and dynamic execution trajectory.

10. The agent skill poisoning detection method based on cross-skill flow and authorization boundary as described in claim 1, characterized in that, It also includes version difference retesting: saving the current skill set's declared capabilities, authorized capabilities, implementation capabilities, observation capabilities, and cross-skill behavior graphs as a baseline; When any skill is updated to a new version, the differences between the multi-layered skill security representation and cross-skill behavior graph of the old and new versions are compared to obtain one or more differences among additions, deletions, modifications, replacements, changes in trigger conditions, changes in authorization scope, changes in relationship evidence, and changes in dependencies; the affected path closure is calculated based on the difference nodes and difference edges; the steps of calculating the actual capability path and authorized capability path, determining cross-skill combination capability overreach, generating cross-skill threat chains, and performing risk assessment and evidence chain generation are repeated only for the affected paths, and the baseline is updated after the detection results are correlated with the detection results of the old version; The calculation of the affected path closure includes the union of explicit graph change paths and implicit data surface dependency paths: identifying the types of shared resources that the change skill can write at runtime, retrieving all other skills in the baseline that read or consume the shared resources, and incorporating the implicit dependencies between the other skills and the change skill formed through shared resources into the affected path closure.

Images