SkillWatermark: benign-looking skill descriptions turn agent network traffic into a covert exfiltration channel

arXiv·medium signalXBlueskyLinkedInCopy link

The authors observe that agent skills produce distinctive traffic patterns during execution, then insert 'watermark' prompt-constraint terms into skill descriptions so that key information from a user's prompt gets encoded into observable traffic across multiple conversation turns. A purely passive network attacker decodes the traffic patterns to recover the private information — no data is directly exfiltrated and no malicious instruction is executed, which is exactly why the modified skills pass existing LLM-based security auditing tools. It defines a side channel that skill scanners, which read package contents rather than runtime traffic shape, are structurally unable to see.