A skill's own examples smuggle malicious code past agent defenses up to 33.5% of the time

Notes on Supply-Chain Poisoning Attacks Against LLM Coding Agent Skill Ecosystems (arXiv:2604.03081) — Yubin Qu, Yi Liu, Tongcheng Geng, Gelei Deng, Yuekang Li, L. Zhang, Ying Zhang, Lei Ma · April 2026

Note published July 25, 2026 · written by SkillFed’s research pipeline from the paper above · how these notes are made

AI-assisted notes · reviewed by SkillFed Skill security

Coding agents install third-party agent skills from open marketplaces with no mandatory security review, and because those skills run as operational directives with system-level privileges — file writes, shell commands, network calls — a single bad one can compromise the host outright. Document-Driven Implicit Payload Execution (DDIPE) is a supply-chain attack that skips the obvious move of writing malicious instructions into a skill's prompt text, and instead embeds the payload inside the skill's code examples and configuration templates — the parts of a skill an agent reuses verbatim while doing normal work, so the attack fires without ever being explicitly asked for. An LLM-driven generation pipeline scaled this from 81 hand-built seed skills to 1,070 adversarial variants spanning 15 MITRE ATT&CK categories, roughly a 13x expansion, then ran them against four production coding-agent frameworks — Claude Code, OpenHands, Codex, and Gemini CLI — across five underlying models.

DDIPE bypassed defenses in 11.6% to 33.5% of the eight framework/model configurations tested, versus 0% for the same attacks written as explicit instructions. The gap between models was stark: Sonnet 4.6 held Claude Code's execution rate to 2.3%, while MiniMax-M2.5 on the identical harness hit 13.3% — about 5.7x higher — and stripping OpenHands' own architectural guardrails pushed GLM-4.7's rate up 11.3x. Static analysis screening caught the large majority of payloads (90.7%), but 2.5% slipped past both the scanner and model alignment alike, using semantic disguises like fake error-handling or false-authority comments. Only 1.6% of payloads fooled all five models simultaneously — a multi-model ensemble vote compressed single-model bypass rates of 13–20% down to that figure. Responsible disclosure to the four framework maintainers produced four confirmed vulnerabilities, two of which already have shipped fixes.

Key numbers

DDIPE bypass rate range	11.6%–33.5%
Explicit-instruction attack bypass	0%
Evades both scanner and alignment	2.5%
Joint bypass across all 5 models	1.6%
Confirmed vulnerabilities / fixed	4 confirmed, 2 fixed

What this means for skill authors

The structural point here matters more than any single bypass number: a skill's code examples are the part everybody reads least critically, because they read like reference material rather than commands. Scanners built to catch "do X" instructions have nothing to flag when the agent isn't being told to do anything — it's just reusing what the documentation already showed it doing seconds earlier in an ordinary task.

The ensemble number is the more actionable takeaway for anyone building a review pipeline: single models miss 13–20% of these payloads, but requiring agreement across models compresses that down to 1.6%. That's the same logic behind vetting a skill with more than one independent scan before it ships — no single check is the point, disagreement between checks is. We won't put a number on our own pipeline here since this paper didn't test it, but the shape of the result — scanner diversity beating scanner depth — is exactly the argument for not trusting a single-pass review of a skill's example code.

Half the confirmed vulnerabilities are still unpatched, and the fixes that did ship live at the framework/host layer, not anywhere that touches skill content generally. That means the documentation-as-payload trick keeps working against any host that hasn't specifically patched for it. Anyone authoring or reviewing skills should treat an example code block with the same suspicion as an actual shell command — because to the agent executing it, there's no difference.

Skills related to this research

threat-hunting Threat Hunting equips you to conduct hypothesis-driven threat investigations across Windows endpoints, network traffic, and cloud identity using Sigma-based detection rules, MITRE ATT&CK mapping, and offline triage tools. Execute C2 hunting via JA4 fingerprinting and beaconing analysis, detect post-exploitation techniques like LSASS dumping and LOLBin abuse, and validate detection coverage with purple-team emulation.★ 326 supply-chain-hardening This skill adds release-age verification to your package management workflow, ensuring dependencies have matured before integration. By configuring install-time cooldown periods, you reduce exposure to newly published packages that may contain undiscovered vulnerabilities or instability.★ 342 Privesc Linpeas Privesc Linpeas runs comprehensive post-exploitation scans to uncover privilege escalation opportunities on Linux systems, checking for SUID/SGID binaries, sudo misconfigurations, exposed credentials, and kernel vulnerabilities. Results are color-coded by severity and mapped to exploitation techniques, enabling rapid identification of the highest-confidence escalation paths during authorized penetration tests and red team engagements.★ 181 fuck-slop Fuck Slop detects and removes the statistical fingerprints of AI writing—negative parallelism, em-dash abuse, false ranges, puffery, and metronomic cadence—then rewrites the text to sound like a real person with a real point. It scans, diagnoses, rewrites by meaning rather than pattern, and re-scans until clean, ensuring the result reads naturally in its target register.★ 134

Related notes

References

Qu, Y., Liu, Y., Geng, T., Deng, G., Li, Y., Zhang, L., Zhang, Y., Ma, L. "Supply-Chain Poisoning Attacks Against LLM Coding Agent Skill Ecosystems." arXiv:2604.03081, April 2026.