# SkillRelayBench

Agent skills leave persistent artifacts such as files, configurations and cached data that later sessions read and reuse, and that cross-session channel can carry malicious influence. The work characterizes three mechanisms, Instruction Propagation, Data Boundary Violation and Evidence Poisoning, and builds SkillRelayBench with 270 adversarial cases; across seven models on Codex CLI, Gemini CLI and Claude Code, attack success rates range from 46.7% to 77.4% and attack chain success rates from 35.6% to 61.1%. The runtime defense SkillRelayGuard restores artifact provenance at read time and adds pre-execution advisory review, lowering overall attack success from 69.5% to 10.9% while raising legitimate task completion from 79.6% to 87.5%.

Agent skills leave persistent artifacts such as files, configurations and cached data that later sessions read and reuse, and that cross-session channel can carry malicious influence. The work characterizes three mechanisms, Instruction Propagation, Data Boundary Violation and Evidence Poisoning, and builds SkillRelayBench with 270 adversarial cases; across seven models on Codex CLI, Gemini CLI and Claude Code, attack success rates range from 46.7% to 77.4% and attack chain success rates from 35.6% to 61.1%. The runtime defense SkillRelayGuard restores artifact provenance at read time and adds pre-execution advisory review, lowering overall attack success from 69.5% to 10.9% while raising legitimate task completion from 79.6% to 87.5%.