StealthyPoison: Manipulating LLM Agent Behavior through Procedural Poisoning of Third-Party Skills

Evidence record

Primary or origin disclosure used to qualify the underlying mechanism, stated prerequisites and limits. arXiv2611.12155: poisoned SKILL.md changes critical formula/constant/logic rather than jailbreak instructions, plus appends plausible retrieval examples. 566 skills, 26,262 competing listings, 5,985 pairs. With forced delivery ~31-33% output incorrect on several models; full registry top1 30.0% and end-to-end Qwen9.8%, Claude Code Opus4.8 49.4% retrieval,10.1% complete ASR, medical38.3%. Static scanners 0-0.7%; semantic judge45.8%.

Read the original source ↗

Claim-level citations (3)

• supportsPoisoned agent skill procedures can redirect tasks without overt malicious instructions: StealthyPoison altered decision-critical steps inside third-party skill procedures so that a retrieved skill could redirect agent actions without relying on an obvious instruction to ignore the user; results come from controlled skill-selection evaluations.

  StealthyPoison, Abstract, attack formulation, procedure-edit and benchmark results

• supportsPoisoned agent skill procedures can redirect tasks without overt malicious instructions: The published results describe controlled evaluations, not confirmed production credential theft or a universal bypass of all skill scanners; exact model and evaluator settings bound the reported successes.

  Abstract, 566 target skills, 5,244 requests, retrieval placement and held-out agent transfer

• supportsPoisoned agent skill procedures can redirect tasks without overt malicious instructions: StealthyPoison researchers modified the decision-critical steps inside third-party agent skills rather than injecting an explicit instruction to disobey the user. The poisoned skill still resembled a legitimate procedure, while its retrieval metadata increased the chance of selection.

  Abstract, 566 target skills, 5,244 requests, retrieval placement and held-out agent transfer