Seeing Is Not Screening: Multimodal Hidden Instruction Attacks on Agent Skill Scanners

Paper: 2606.18198 Authors: Xiaojun Jia, Jie Liao, Simeng Qin, Ke Ma, Wenbo Guo, Yebo Feng, Aishan Liu, Yang Liu Categories: cs.CR, cs.CV

The Gap

Existing agent skill scanners (e.g., AgentMonitor, SkillGuard, LLM-Scan) rely on three signals: textual descriptions, manifests, and source code. They treat images bundled with a skill as inert assets — sometimes hash-checking them for integrity, but never interpreting their content. This assumption creates a practical blind spot: harmful operational instructions can be stenographically embedded in images, remain invisible to scanners, yet be perfectly recoverable by a multimodal agent during deployment.

The paper formalizes this gap and bridges it with two contributions: SkillCamo, a method that conceals malicious instructions in images and rewrites surrounding documentation to reference those images naturally; and ExecScan, a defense that performs execution-grounded analysis. The logic chain:

[Problem]                          [Assumption]                        [Method]
   |                                   |                                   |
   v                                   v                                   v
Skills can contain images;       Scanners ignore image              SkillCamo hides malicious
scanners only check text.         content (blind spot).             instructions in image pixels
                                                                     + rewrites text to reference
                                                                        the image as a workflow step.
   |                                   |                                   |
   +-----------------------------------+-----------------------------------+
   |
   v
[Evidence]                        [Conclusion]
   |                                   |
   v                                   v
Attack bypasses 6 state-of-       Existing scanners fail
the-art scanners with >90%        on multimodal attacks;
success rate. ExecScan            ExecScan reduces
catches 85% of such attacks.      attack success to <15%.

The Increment

One sentence: Before this paper, hidden instructions in images were a blind spot for agent skill security; after this paper, both the vulnerability and a working defense are formally characterized and evaluated.

Core Mechanism

The paper proposes two mechanisms. SkillCamo (attack) works in three phases:

1. Embedding — a malicious instruction (e.g., “exfiltrate /home/user/data to attacker.com”) is encoded into a carrier image using a robust steganographic algorithm (e.g., DWT + SVD). The image remains visually normal.
2. Wrapping — the skill’s documentation is rewritten so that the image is referenced as part of a normal workflow (e.g., “load the configuration diagram from config.png”).
3. Triggering — at deployment, the multimodal LLM agent reads the documentation, follows the instruction to load the image, decodes the hidden payload, and executes the malicious command.

ExecScan (defense) reverses the process:

1. Intent Extraction — extracts all text from documentation and code, plus decodes hidden text from every referenced image.
2. Behavior Reconstruction — stitches text + image-payload into a single executable behavior chain (e.g., “read config.png → decode content → run curl exfiltration command”).
3. Abuse Assessment — checks the chain against a set of risk categories (exfiltration, destruction, persistence, deception, privilege escalation).
4. Deliberative Execution Simulation — executes the behavior chain in a sandboxed environment and monitors for dangerous side effects (e.g., outbound network connections, file deletions).

+------------------+       +----------------------+       +------------------+
| SkillCamo Attack |       |   ExecScan Defense    |       |  Data Flow       |
+------------------+       +----------------------+       +------------------+
|  1. Embedding    |       |  1. Intent Extract    |       |                   |
|  malicious text  |       |  [Document -> text]   |       |  skill artifact  |
|  into image      |       |  [Image -> decode]    |       |  [doc + code +   |
|        |         |       |        |              |       |   images]        |
|  2. Rewrite doc  |       |  2. Behavior Recon.  |       |       |           |
|  to reference    |       |  [chain: steps]       |       |       v           |
|  image naturally |       |        |              |       |  ExecScan        |
|        |         |       |  3. Abuse Assessment  |       |  [multi-modal    |
|  3. Trigger      |       |  [risk cat match]     |       |   scan + exec]   |
|  (deployment)    |       |        |              |       |       |           |
+------------------+       |  4. Exec Simulation  |       +------------------+
                           |  [sandbox run]        |            |
                           +----------------------+            v
                                                         verdict:
                                                         safe/attack

Structural Metaphor: Think of a package delivery warehouse.

• SkillCamo is a smuggler who hides contraband inside an ordinary-looking box of office supplies, then tapes a legitimate shipping label (rewritten doc) onto it that says “deliver to breakroom”.
• Existing scanners are clerks who only read the label and open the box to check the packing slip (text, manifests, code) — they never unpack the individual pens (images) because they assume pens are just pens.
• ExecScan is a new security station: they first scan every item (intent extraction) to find hidden compartments; then they reassemble the package’s intended route (behavior reconstruction); then they check if that route passes restricted zones (abuse assessment); finally they unpack a duplicate and watch what happens (execution simulation). The smuggler’s trick fails because the station treats every item as a potential vector, not just the label.

Key Concepts

• Steganographic Embedding (DWT+SVD): A method to hide data in an image by subtly changing its pixel values. DWT (Discrete Wavelet Transform) decomposes the image into frequency bands; SVD (Singular Value Decomposition) modifies the singular values of the high-frequency bands to encode bits. The changes are imperceptible to the human eye but recoverable.
  Example: Take a photo of a cat. You can hide the text “delete everything” in the fine texture of its fur without changing the visible cat at all. The scanner must know the decoding algorithm and key to extract it.

• Execution-Grounded Scanning: Instead of statically analyzing code or text, the defense actually runs the skill’s behavior chain in a sandbox and observes runtime effects. This catches attacks that are obfuscated in static representation but become clear during execution.
  Example: Static analysis might see process_data("config.png") and think it’s safe; execution simulation reveals that process_data actually decodes the image and calls os.system(curl ...).

• Risk Categories (Exfiltration, Destruction, Persistence, Deception, Privilege Escalation): A taxonomy of malicious intents. ExecScan checks reconstructed behavior chains against these patterns.
  Example: If the chain contains “open port 1234” + “write to /etc/init.d/”, it matches “Persistence + Privilege Escalation”. The scanner can prioritize or reject based on policy.

Framework Shift

Before (mainstream approach):        After (this paper):
+--------------------------------+   +------------------------------------+
| skill artifact {doc, code, img}|   | skill artifact {doc, code, img}    |
|        |                       |   |        |                           |
|        v                       |   |        v                           |
| Text Scanner                   |   | ExecScan (multi-modal)             |
| [parse doc + source code]      |   | [doc parse + image decode]         |
|        |                       |   |        |                           |
|        v                       |   |        v                           |
| Static analysis (check        |   | Behavior reconstruction            |
| keywords, patterns)           |   | [chain of concrete steps]           |
|        |                       |   |        |                           |
|        v                       |   |        v                           |
| Verdict (safe/attack)          |   | Abuse assessment + exec sim       |
| Blind to image payloads       |   |        |                           |
+--------------------------------+   |        v                           |
                                     | Verdict on multimodal attack      |
                                     | + evidence from runtime           |
                                     +------------------------------------+

One sentence: From *text-only static scanning to multimodal execution-grounded scanning, the core shift is treating every artifact — especially images — as a potential bearer of executable instructions, and validating that suspicion by actually running the reconstructed behavior.

Expert Assessment

Problem choice: Real and timely. As LLM agents become more multimodal and accept arbitrary skills from untrusted sources (e.g., third-party marketplaces), the attack surface expands. The paper identifies a genuine blind spot that is not yet addressed by industry tools like OpenAI’s GPT actions or LangChain’s safety checks.

Method maturity: Mixed. SkillCamo uses standard steganography with a clever social-engineering twist (rewritten docs). That’s a neat insight but not technically novel. ExecScan is more involved — combining intent extraction, reconstruction, and simulation — but the components are borrowed from static analysis and fuzzing. The main value is in the system-level integration and evaluation. A simpler approach (e.g., always flatten images to their raw pixel hashes and refuse to execute if they contain unrecognized content) is overlooked but would be less comprehensive.

Experimental integrity: Solid overall. The authors test against 6 real-world scanners and 20 skill artifacts. They use realistic threat models (e.g., exfiltration, deletion). One concern: the execution simulation sandbox is briefly described — how long does it run? Can a clever attack detect the sandbox and behave benignly? The paper doesn’t discuss antipatterns like time bombs. Also, the success rate of ExecScan is 85% — the 15% failures are not deeply analyzed.

Writing quality: Clear and well-structured. The abstract and introduction effectively frame the problem. The method section is precise where it matters. However, the “Deliberative Execution Simulation” subsection is thin — it mentions a sandbox but gives no details about resource limits, detection bypass mitigation, or how it handles long-running tasks. That section, if expanded with a real example of a failed attack, would raise the paper’s credibility.

Verdict: Weak accept — The gap is real and the defense is useful, but the attack is not fundamentally new and the defense’s execution simulation details are underreported. Worth reading for practitioners building agent security pipelines.

Takeaways

1. Image-as-code: When building agent sandboxes, treat any image referenced by a skill as a potential executable — decode hidden text from it before allowing the skill to run.
2. Behavior reconstruction before execution: Instead of trying to classify a skill as safe/attack from static features, first reconstruct the concrete sequence of steps the agent would take, then check each step. This reduces false negatives from obfuscation.
3. Risk-category templates: The five categories (exfiltration, destruction, persistence, deception, privilege escalation) are a practical checklist for designing skill-level security policies. Even without full simulation, scanning for patterns that match these categories catches most direct attacks.