PROTEUS: A Self-Evolving Red Team with Surface Expansion for Agent Skill Ecosystems

Agent skills extend LLM agents with reusable instructions, tool interfaces, and executable code, and users increasingly install third-party skills from marketplaces, repositories, and community channels. Because a skill exposes both executable behavior and context-setting documentation, its deployment risk cannot be measured by single-shot audits or prompt-level red teams alone: a realistic attacker can use audit and runtime feedback to repeatedly rewrite the skill. We frame this risk as \textbf{adaptive leakage}—whether a budgeted attacker can iteratively revise a skill until it passes audit and produces verified runtime harm—and present \textbf{Proteus}, a grey-box self-evolving red-team framework for measuring it. Proteus searches a formalized five-axis skill-attack space. Each candidate is evaluated through a unified audit-sandbox-oracle pipeline that returns structured audit findings and runtime evidence to guide cross-round mutation. Beyond initial evasion, Proteus performs path expansion, which finds alternative implementations of successful attacks, and surface expansion, which transfers learned implementation patterns to new attack objectives beyond the original seed catalogue. Across eight phase-1 mutator-target-defender configurations, Proteus achieves 40-90\% \textbf{ASR@5} and exhibits positive learning-curve slopes on both evaluated auditors. In the full 8-cell expansion matrix, Proteus generates 438 jointly bypassing and lethal variants; SkillVetter is bypassed at $\geq$ 93\% in every expansion cell, and AI-Infra-Guard, the strongest public auditor we evaluate, still admits jointly successful variants at up to 41.3\%. These results show that current skill vetting substantially underestimates residual risk when evaluated against adaptive, feedback-driven attackers. Code: \url{https://anonymous.4open.science/r/proteus/}.