Overview

This chapter reframes confirmed malicious third-party agent skills as attack systems whose behaviors can span reconnaissance, credential access, execution, defense evasion, exfiltration, and impact. In the USENIX sample, the median confirmed skill covered three of six phases, while 68.2% covered at least three and 80.3% contained three or more labeled vulnerabilities. Phase breadth shows layered capability, not a fixed sequence, motive, or complete campaign.

Learning outcomes

A skill may begin with host-granted authority, so reconnaissance or privilege escalation is not always required.
Phase breadth matters: the median confirmed skill covered three of six phases, but presence does not prove a complete chain.
Severity and sophistication are different; a simple critical action can coexist with a more layered, concealed package.

Keywords

Agent skillsAttack chainCredential accessExecutionExfiltrationSophistication

The Attack Is a Chain, Not a Red Flag

The confirmed malicious skills in the public ecosystem are best understood as small attack systems, not as files with one bad line. This chapter traces the six phases used in the USENIX study—reconnaissance, credential access, execution, defense evasion, exfiltration, and impact—and asks what changes as a skill moves through them. The practical result is a way to recognize technique layering while keeping two distinctions intact: a phase can be present without forming a complete chain, and a severe individual behavior is not necessarily evidence of a sophisticated campaign.

From an installation boundary to an attack lifecycle

A lifecycle model is useful because the same operation means something different depending on what came before it and what it enables next. In this study, reconnaissance means looking for useful information about the local environment; credential access means obtaining secrets or authentication material; execution means running commands or additional code; defense evasion means hiding the behavior or making it harder to interpret; exfiltration means sending data to an external destination; and impact means changing the agent’s or host’s behavior in a way that advances the attacker’s objective.

These names are not a claim that every skill visits the phases in a neat six-step order. They are a way to describe security-relevant capabilities and the relationships among them. A skill may begin with credential access because it has already entered an authenticated user environment. It may execute a downloaded component before collecting data, or use an instruction-level effect to alter the agent’s behavior without needing a conventional executable payload. The lifecycle is therefore a map of possible transitions, not a script that every sample follows.

stateDiagram-v2 [*] --> RECON: optional discovery [*] --> CRED: pre-granted host access RECON --> CRED: locate useful material CRED --> EXEC: collected access enables action EXEC --> EVADE: conceal when useful EXEC --> EXFIL: transmit collected data EVADE --> EXFIL: hidden transmission EXFIL --> IMPACT: affect agent or host state "Reconnaissance" as RECON state "Credential Access" as CRED state "Execution" as EXEC state "Defense Evasion" as EVADE state "Exfiltration" as EXFIL state "Impact" as IMPACT state "Multiple phases may coexist in one skill" as MULTI CRED --> MULTI EXEC --> MULTI EVADE --> MULTI EXFIL --> MULTI IMPACT --> MULTI MULTI --> [*]

The starting conditions explain an unusual feature of the result. In conventional malware, an attacker may need to discover the environment, exploit a weakness, obtain more privileges, and only then reach valuable data. A locally executed skill can begin after a user has already installed it and after the agent has received authority from its host. Reconnaissance is consequently less necessary, and a separate privilege-escalation stage is not always required. The package begins closer to the point where a conventional attack would hope to arrive.

The study found reconnaissance in only 12 of 157 confirmed skills, or 7.6%. By contrast, execution appeared in 118 skills, or 75.2%; impact in 109, or 69.4%; credential access in 107, or 68.2%; and exfiltration in 90, or 57.3%. Defense evasion appeared in 25 skills, or 15.9%. The uneven distribution is not evidence that reconnaissance or evasion are unimportant in general. It reflects the particular trust model of agent skills: once the package is admitted, the highest-value steps can be attempted directly.

Credential access can be an early consequential transition in this setting.

Published by DeepMox

FAQ

What are the six attack phases used in the study?

They are reconnaissance, credential access, execution, defense evasion, exfiltration, and impact. The model describes capabilities and transitions; it does not claim every skill follows all six in order.

Does covering more attack phases prove that a skill is more sophisticated?

Not by itself. Phase coverage indicates breadth, while sophistication also reflects technique layering, concealment, and attacker investment; the study treats severity and sophistication as separate dimensions.

What does the median of three covered phases mean?

It means the middle confirmed skill covered three of the six modeled phases; it does not mean every skill followed a three-step sequence or completed an attack.

Previous10 minThird-Party Agent Skills: Authority and Evidence

Next10 minThird-Party Agent Skills: Data Thieves vs Agent Hijackers

Third-Party Agent Skills: Attack Chains

The Attack Is a Chain, Not a Red Flag

From an installation boundary to an attack lifecycle

FAQ