Poisoned agent skill procedures can redirect tasks without overt malicious instructions

StealthyPoison researchers modified the decision-critical steps inside third-party agent skills rather than injecting an explicit instruction to disobey the user. The poisoned skill still resembled a legitimate procedure, while its retrieval metadata increased the chance of selection.

The authors tested 566 eligible skills and 5,244 requests in a larger registry, creating surrogate tasks and feedback without knowledge of future victim requests. They reported transfer to held-out models and an end-to-end Claude Code workflow. A reusable skill is a privileged procedure source once an agent adopts it. Relevance ranking and procedural integrity need separate checks because a skill can be topical and syntactically harmless while its decision rule is wrong.

The published results describe controlled evaluations, not confirmed production credential theft or a universal bypass of all skill scanners; exact model and evaluator settings bound the reported successes. Verify skill provenance and hashes at use time, compare actions against independently specified user objectives, and test novel tasks rather than only known injected strings.

Evidence reconciliation and effect boundary. The attacker does not need to place a conspicuous jailbreak at the top of the file. A plausible-looking sequence of task steps can steer an assistant after retrieval while preserving enough ordinary skill language to evade simplistic keyword checks. The demonstrated problem sits between search ranking, trusted procedure selection and subsequent action authorization. Detection scores on selected benchmarks are not proof of field compromise or a working exploit against all skill registries.