- Persistent files need provenance across sessions.
- Trace both the writer and the reader of a handoff.
- Benchmark cases do not count real-world incidents.
The file carries context forward
Some agents keep generated files after a conversation ends. A later skill may read those files while having no access to the earlier conversation. The file has become a handoff between trust contexts. SkillRelayBench studies this pattern in a controlled setting where an attacker controls multiple third-party skills, not the user request or the agent policy.
Map writers and readers
List each persistent artifact, its writer, expected format, read path, expiry, and the decision that depends on it. Inspect whether a downstream skill accepts a destination, command, or claimed approval solely because it appears in an artifact. A valid format does not establish authority.
A bounded review exercise
Illustrative scenario: one third-party skill writes a status file claiming that a later export was approved. A second skill reads the file in a new session and offers to send a report. This fictional example is not a reported breach. Compare the claim against user authorization and independent provenance before any external action.
Read the benchmark carefully
The paper evaluates 270 constructed adversarial cases spanning 30 scenarios and 10 domains, and reports results for a proposed defense in selected agents. Those numbers describe its experimental matrix, not a census of public skills. The related cross-skill pretext paper asks a similar causal question, but its construction is distinct.
Sources & scope
This guide combines editorial explanation and practical review suggestions. Linked sources support the underlying concepts; this site has not independently replicated their experiments.
S38