Jingfen Qiao

Third-party skills in public registries can be exploited by a poisoning method that edits only decision rules while leaving the task and interface intact. Without real user requests or ground-truth answers, StealthyPoison uses synthetic requests and clean executions by a surrogate agent as references to iteratively rewrite formulas, thresholds and branches. Across 566 eligible skills, 5,244 requests and more than 26,000 registry entries, the frozen poisoned skills reached micro-averaged attack success of 31.0%–31.9% on three held-out models, close to the surrogate's 32.9%.

Third-party skills in public registries can be exploited by a poisoning method that edits only decision rules while leaving the task and interface intact. Without real user requests or ground-truth answers, StealthyPoison uses synthetic requests and clean executions by a surrogate agent as references to iteratively rewrite formulas, thresholds and branches. Across 566 eligible skills, 5,244 requests and more than 26,000 registry entries, the frozen poisoned skills reached micro-averaged attack success of 31.0%–31.9% on three held-out models, close to the surrogate's 32.9%.