A few rewritten decision rules in a third-party skill make agents answer wrong while running normally, and most scanners miss it

When an agent pulls a third-party skill from a public registry, an attacker can change only the rules that determine the answer, so the task runs to completion but returns a wrong result without any overt malicious instruction. Earlier skill-poisoning studies used malicious instructions or bundled scripts to induce unauthorized actions, behavior beyond the skill's advertised task that checks for unnecessary operations, policy violations or suspicious artifacts can expose; whether a skill can instead be rewritten to keep execution normal and only corrupt the outcome had not been examined. On 566 eligible target skills from SRA-Bench, 89% of constructed payloads flipped at least one synthetic-query answer, with 72% flipping some queries and 17% flipping all; on the original evaluation requests not used in construction, the surrogate execution agent Qwen3-Coder-30B reached a micro-averaged attack success rate of 32.9%.

Constructing the payload needs neither real user requests nor ground-truth answers; it starts from the skill's own documentation and searches for edits using the surrogate agent's clean outputs as a reference. Earlier knowledge-poisoning methods crafted poisoned content for known question–answer pairs, so the attacker had to know in advance what would be asked and what the correct answer was; here the attacker has only the public skill and the public registry. The pipeline first synthesizes execution requests from the skill documentation with a public LLM, runs the clean skill with a surrogate agent to obtain pseudo-references, has a planning agent mark formulas, boundary conditions, field interpretations, aggregation rules or operation order that can affect the final answer, then iterates rewrites under constraints preserving task, interface and executability, with a critic agent comparing outputs, for at most 10 iterations. Frozen payloads transfer unmodified to Llama-3.3-70B, Mistral-Small-24B and GPT-OSS-20B at micro-averaged attack success rates of 31.0%, 31.3% and 31.9%.

Getting the poisoned skill actually selected also requires appending predicted request descriptions to its retrieval metadata, again without victim-retriever scores or feedback. The gradient-based retrieval-poisoning baselines HotFlip and GCG need access to retriever gradients to optimize metadata, which an attacker typically does not have. Under full-registry competition against more than 26,000 entries, StealthyPoison raised PoisonHit@1 from 15.8% for the no-optimization baseline to 30.0% and PoisonHit@20 from 52.3% to 67.6%, a 13.6% improvement in top-1 poisoned-skill placement over both HotFlip and GCG; in a Claude Code workflow powered by Opus 4.8, 73.2% of 720 sampled queries placed a poisoned skill in the top 20, 49.4% selected one, and end-to-end attack success was 10.1%.

Evaluation ran on offline benchmarks and locally constructed test registries; no poisoned skills were submitted to public marketplaces, and no real users or deployed systems were attacked, so measured attack success may differ from real systems. Results cover six SRA-Bench task families, five execution models, several retrievers and seven selectors, plus four pre-execution screeners: SkillSpector, Cisco Skill Scanner, VirusTotal and GPT-5.4-mini.

Attack effectiveness varies widely by task: MedCalc has the highest end-to-end attack success, while BigCode reaches only 5.0% despite a 60.8% poisoned-skill selection rate, so selection does not equal behavioral compromise. In the defense evaluation, SkillSpector, Cisco Skill Scanner and VirusTotal detected only 0.7%, 0.4% and 0.0% of poisoned skills, and GPT-5.4-mini 45.8%, and these settings are not the scanners' full recommended LLM-enabled configurations. The authors note that GPT-5.4-mini more often catches explicit contradictions, reversed rules and instructions to skip validation, and is less reliable when a modified formula, constant, branch or interpretation rule resembles a plausible task procedure; defenses need behavioral validation, such as testing candidate skills on reference requests or comparing outputs with trusted implementations.