AutoSkillDrain: Resource Amplification Attacks on LLM Agents via Malicious Skill Optimization

LLM agents increasingly rely on reusable skills to acquire domain-specific capabilities, but this extensibility also creates a new supply-chain surface for resource-amplification attacks. A malicious skill can induce prolonged generation, thereby increasing cost, latency, and service pressure. To systematically study this threat, we propose AutoSkillDrain, the first black-box resource-amplification attack framework that automatically transforms benign agent skills into resource-draining variants without access to the victim agent's system prompts, or internal execution policies. We further introduce SkillDrainBench, a benchmark consisting of public source skills, optimized malicious counterparts, and task instances for evaluating amplification, utility, transferability, and detectability. Across experiments on three agent backends and multiple models, AutoSkillDrain achieves the strongest resource amplification among compared methods, with 2.57$\times$, 2.15$\times$, and 2.28$\times$ average output amplification on PydanticAI, OpenClaw, and Claude Code, respectively, while maintaining over 91% task completion. These results expose an underexplored resource-security risk in open skill ecosystems and highlight the need for validation before deployment.