Agent skills hand off across sessions: one line written into a file upstream gets followed downstream, with attack success up to 77.4%

Files, configurations, and database records left behind when an agent runs a skill are read by other skills in later sessions, so malicious influence can cross sessions even after the conversation history is reset. Earlier work on skill security examined vulnerabilities, malicious behavior, and credential leakage in skill ecosystems, and built package auditing and malicious-skill detection, but did not adequately examine how multiple attacker-controlled skills coordinate attacks across independent sessions through persistent task artifacts. On 270 adversarial cases drawn from 30 two-stage task scenarios across ten domains, seven models across Codex CLI, Gemini CLI, and Claude Code reach attack success rates of 46.7% to 77.4% and attack chain success rates of 35.6% to 61.1%.

An attacker does not need to touch files between sessions; controlling an upstream and a downstream skill package is enough to make the agent write attack content into an artifact and then read and act on it in a later task. The upstream skill induces the agent to write attack-related content into artifacts, and the downstream skill guides its use in a later session, while the attacker cannot observe execution results, adapt payloads during execution, or directly modify files between sessions. The study characterizes three attack patterns: Instruction Propagation makes the agent follow instructions embedded in artifacts during later tasks, Data Boundary Violation uses data beyond its authorized scope in later tasks, and Evidence Poisoning manipulates the factual basis of later decisions; grouped by attack pattern, Evidence Poisoning has an overall attack chain success rate of 61.0%, above Instruction Propagation at 49.5% and Data Boundary Violation at 40.0%.

SkillRelayGuard restores an artifact's provenance and usage boundary when the agent reads it, and an independent reviewer supplies evidence and revision advice before a concrete operation executes, while the task-execution agent keeps the final decision. Simply rejecting artifact reuse would interrupt legitimate workflows, and directly trusting the instructions and factual claims in artifacts would perpetuate attacks, so a defense has to reassess authorization and factual support while keeping artifact reuse. Across three agent configurations, overall attack success rate falls from 69.5% to 10.9% and attack chain success rate from 54.8% to 10.0%, while legitimate task completion rises from 79.6% to 87.5%; an ablation shows that combining read-time context restoration with pre-execution review reduces attack success more than either intervention alone.

The work targets agent workflows that use third-party skill packages and continue across sessions, evaluated non-interactively in isolated Docker environments without manual approval of tool calls. The defense prototype connects to Codex CLI, Claude Code, and Gemini CLI through platform-specific adapters, and provenance records live outside the agent-writable workspace. A reader following up can look to the direction the authors propose: distinguish provenance, factual support, and user authorization, and reassess artifact use before executing a concrete operation.

Judging is done by separate agent judges, which may misinterpret borderline cases; agent execution is stochastic, so individual outcomes vary with sampling and execution paths, and cross-configuration evidence does not replace repeated runs within the same configuration; the ablation study uses only Codex CLI, and the generalizability of component contributions to other configurations remains to be validated; the benchmark cannot exhaustively cover real-world scenarios, and generalization to other workflows requires further validation. SkillRelayGuard enforces context delivery and review but leaves the final content-level decision to the agent, which may disregard restored context or confirm a request despite review advice, leaving residual attack risk.