SchemaGuard: Structure-Aware Detection of Tool-Poisoning and Skill-File Attacks in the LLM Agent Tool Supply Chain

Abstract

: Large Language Model (LLM) agents increasingly extend their capabilities by integrating third-party tools, most prominently via the Model Context Protocol (MCP), and by loading reusable skill files that inject procedural knowledge at runtime. This composability has created a new and largely unguarded software supply chain: an agent trusts the natural-language descriptions, parameter schemas, and skill bodies it ingests, yet any of these artifacts may carry adversarial instructions crafted to hijack tool selection, exfiltrate credentials, or install persistent policy-like directives. Existing defenses overwhelmingly operate at run time, inspecting model inputs and outputs while the agent executes, and they treat the incoming artifact as flat, undifferentiated text. We argue that a complementary and under-explored line of defense is pre-integration vetting: analyzing a candidate tool or skill before it is ever admitted into the agent. This paper introduces SchemaGuard, a structure-aware guard model that screens MCP tool manifests, tool and parameter descriptions, and skill files for supply-chain poisoning at admission time. We scope the contribution to this one-time admission decision, and position it as a necessary layer that composes with, rather than replaces, runtime containment and post-approval lifecycle controls such as signing and rescanning. SchemaGuard serializes each candidate artifact into a typed, field-delimited representation so that a compact fine-tuned language model can reason about where in the structure a malicious instruction hides, and it couples this static analyzer with a lightweight dynamic sandbox that flags capability and declaration mismatches. The model emits a calibrated trust score, a multi-label attack-category prediction, and a span-level localization of the offending text. We construct SchemaGuard-Bench, a labeled corpus of benign and poisoned artifacts spanning six attack families, and evaluate under a random split, a zero-shot held-out-category split, and an adaptive-attacker split. SchemaGuard attains an F1 of 0.946 and an Area Under the Receiver Operating Characteristic Curve (AUROC) of 0.981 on the random split, retains an F1 of 0.883 on entirely unseen attack categories, and outperforms a keyword baseline, an off-the-shelf prompt-injection guard, and a much larger frontier LLM-as-judge, while processing artifacts roughly two orders of magnitude more cheaply than the frontier judge. Ablations confirm that explicit structure-awareness, rather than model scale, is the dominant driver of accuracy.