Metadata-only changes can manipulate the agent before a skill runs. The researchers deliberately evaluated the complete discovery pathway rather than assuming an attacker-controlled skill was already installed or selected. They measured malicious-skill selection outcomes, not production exfiltration. This distinction matters because authenticity of package…
Inspect the ClaimsCase · DiggingBeagle record
Skill metadata poisoning changes which capability an agent actually selects
MetaCascade changes skill descriptors and optimizes competition for retrieval and selection. Across four datasets and two controlled agents, the study measured 74.24% final malicious-skill selection without defenses and 63.33% averaged across defense configurations.
Scope
Controlled multi-dataset experiment on Hermes and OpenClaw, not an observed malware distribution campaign.
Assessment profile
Assessment method- Setting
- evaluation
- Exploitation
- demonstrated
- Evidence
- Grade B
- AI role
- AGAINST AI
Basis and provenance
The authors measured skill-discovery and selection manipulation under controlled search conditions, not a counted real-world campaign or full downstream compromise. Assessment uses the pinned Claims and source identities; public primary pages were not independently retrievable during this run. Impact remains unrated because field consequence or a comparable scoring rubric is not established.
Assessed Oct 15, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-CP7-META-ASR · CLM-CP7-META-BENCH · CLM-CP7-META-BOUNDARY · MetaCascade: End-to-End Attacks on Agent Skills via Metadata-Only Poisoning
At a glance
Real-world agent registry prevalence and actual downstream code execution were not measured. Selection can be influenced even if an independent runtime effect gate prevents dangerous tool use.
Limits and uncertaintyFull account
Metadata-only changes can manipulate the agent before a skill runs. The researchers deliberately evaluated the complete discovery pathway rather than assuming an attacker-controlled skill was already installed or selected. They measured malicious-skill selection outcomes, not production exfiltration. This distinction matters because authenticity of package contents, rank of search results, and authority to execute are separate checks.
This attack acts before a skill’s code or long instructions are evaluated. Ranking and metadata can determine whether the malicious candidate reaches the agent at all; validating only the eventual skill body misses that earlier selection step.
Claims & evidence
CLM-CP7-META-ASRAverage malicious-skill selection was 74.24% without defense, 35.53 percentage points above the strongest baseline; under four defenses the average was 63.33%.supported
Basis: reported finding
- supportsMetaCascade: End-to-End Attacks on Agent Skills via Metadata-Only Poisoningprimary disclosure
Abstract; Section 5.2 Overall Attack Effectiveness
CLM-CP7-META-BENCHMetaCascade evaluated end-to-end attacker-skill selection on four datasets with Hermes and OpenClaw, including black-box competition feedback and four defensive settings.supported
Basis: reported finding
- supportsMetaCascade: End-to-End Attacks on Agent Skills via Metadata-Only Poisoningprimary disclosure
Abstract; Sections 4-5 experimental setup
CLM-CP7-META-BOUNDARYIts attack-success definition is final selection of the targeted malicious skill following retrieval, not completed exploitation or unauthorized effect.supported
Basis: reported finding
- supportsMetaCascade: End-to-End Attacks on Agent Skills via Metadata-Only Poisoningprimary disclosure
Section 1 Contributions; Section 5.1 Evaluation Metrics
Unknowns and contradictions
- Real-world agent registry prevalence and actual downstream code execution were not measured.
- Selection can be influenced even if an independent runtime effect gate prevents dangerous tool use.
Sources and citation
Material revision history
- Oct 15, 2026 · Canonical change recorded · new in release · revision 150