How Your Credentials Are Leaked by LLM Agent Skills: An Empirical Study

This article presents a comprehensive empirical study on credential leakage in Large Language Model (LLM) agent skills, analyzing 17,022 skills from the SkillsMP marketplace. The study uncovers 1,708 security issues across 520 affected skills, identifying critical vulnerabilities linked to debug logging and the cross-modal nature of credential exposure. The findings highlight the urgency for enhanced security measures in LLM frameworks, as a significant portion of leaked credentials is exploitable without elevated privileges, and the study includes a released dataset and detection pipeline to aid future research in agent security.