The report
A reusable agent skill often arrives as a Markdown file that looks like implementation guidance. In the Poisoned Skills study, researchers inserted adversarial instructions into that channel and measured the resulting model responses against 270 prohibited questions across seven open-weight models. The average success rate was 0.5 percent with a benign setup and 45 percent with the injected skill; model-specific results varied substantially.
The experiment establishes the power of an instruction placed at initialization in this selected harness. It does not show that 45 percent of installed skills are malicious, that real users experienced the tested outcomes, or that an adversary achieved host-level access. The measured endpoint was a harmful model completion, not a filesystem write or a stolen credential.
The file's purpose made the attacker text credible
A skill is supposed to guide how the agent works. That makes it a more attractive injection surface than ordinary retrieved data, especially when the runtime loads the file into a high-priority context. The paper also reports that some obfuscation methods did not improve attack success, so elaborate hiding is not a necessary explanation of the observed failures.
The Case tracks the benchmark and its denominator. A proper defense assessment should check who supplied a skill, whether its content can override trusted instructions and whether tool permissions are enforced independently of the generated answer.