SkillShield defends coding agents from the system prompt alone, matching Llama Guard 3 with no runtime classifier

arXiv·medium signalXBlueskyLinkedInCopy link

arXiv 2608.25817 (26 Aug) synthesizes security skills offline from known attacks and recorded agent failures, injects them into the system prompt at session start, and leaves them active through the tool-use loop, so API-only deployers who cannot touch weights get a defense with no auxiliary classifier or execution monitor in the trajectory. Across six models on RedCode the default all-classes skill dropped malware-generation severity from 3.37 to 0.58 and reached a 43.6% execution attack success rate, comparable to Llama Guard 3's 42%. The paper compares three fixed system-prompt budgets, all-classes, per-bundle and per-class, none of which needs runtime request routing.