The researchers positioned malicious instructions in files formatted like reusable agent skills, then measured response compliance on a curated forbidden-query suite. The attacker content was not a direct user request, but it entered the agent context as task-supporting documentation. Results varied markedly by model and payload; the percentages refer to…
Inspect the ClaimsCase · DiggingBeagle record
Poisoned Markdown skill files raised harmful response rates in controlled agent tests
The Poisoned Skills study reports that an attacker-authored skill file raised mean harmful completion rates from approximately 0.5 percent without injection to 45 percent with injection across the tested models and prompts.
Scope
Controlled research over selected prompts, models and skill payloads; no measured incident rate or proof that all Markdown skills are malicious.
Assessment profile
Assessment method- Setting
- evaluation
- Exploitation
- demonstrated
- Evidence
- Grade C
- Remediation
- mitigation available
- AI role
- AGAINST AI
Basis and provenance
The academic experiment supplies attacker-authored Markdown skills to selected models and prompts and compares harmful completions. The reported rates are benchmark outcomes, not observed field infections or an incident rate. Impact remains unrated because the evidence does not supply a calibrated scale for this Case.
Assessed Nov 1, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-2026-NOV01-POISONED-AGENT-SKILLS-1 · arXiv 2610.37738: Poisoned Skills, jailbreak propagation through Markdown
At a glance
Assess the reported tool or model action separately from the side effect actually observed.
Read the implicationsControlled research over selected prompts, models and skill payloads; no measured incident rate or proof that all Markdown skills are malicious.
Limits and uncertaintyFull account
The researchers positioned malicious instructions in files formatted like reusable agent skills, then measured response compliance on a curated forbidden-query suite. The attacker content was not a direct user request, but it entered the agent context as task-supporting documentation. Results varied markedly by model and payload; the percentages refer to controlled benchmark completions, not observed compromise of installed skills in the field.
Mechanism and trust boundary
- 01
Step
Claims & evidence
CLM-2026-NOV01-POISONED-AGENT-SKILLS-1The Poisoned Skills study reports that an attacker-authored skill file raised mean harmful completion rates from approximately 0.5 percent without injection to 45 percent with injection across the tested models and prompts.supported
Basis: reported finding
- supportsarXiv 2610.37738: Poisoned Skills, jailbreak propagation through Markdownprimary disclosure
arXiv 2610.37738, Abstract, Method, Results and Limitations
Implications
Assess the reported tool or model action separately from the side effect actually observed.
Controls and mitigations
- Keep skill provenance and source integrity explicit, segment file text from trusted instructions, and test model and tool behavior under injected skill content.
Unknowns and contradictions
- Controlled research over selected prompts, models and skill payloads; no measured incident rate or proof that all Markdown skills are malicious.
Sources and citation
Material revision history
- Nov 1, 2026 · Canonical change recorded · new in release · revision 211