A skill's own examples smuggle malicious code past agent defenses up to 33.5% of the time

Notes on Supply-Chain Poisoning Attacks Against LLM Coding Agent Skill Ecosystems (arXiv:2604.03081) — Yubin Qu, Yi Liu, Tongcheng Geng, Gelei Deng, Yuekang Li, L. Zhang, Ying Zhang, Lei Ma · April 2026

Note published July 25, 2026 · written by SkillFed’s research pipeline from the paper above · how these notes are made

AI-assisted notes · reviewed by SkillFed Skill security

Coding agents install third-party agent skills from open marketplaces with no mandatory security review, and because those skills run as operational directives with system-level privileges — file writes, shell commands, network calls — a single bad one can compromise the host outright. Document-Driven Implicit Payload Execution (DDIPE) is a supply-chain attack that skips the obvious move of writing malicious instructions into a skill's prompt text, and instead embeds the payload inside the skill's code examples and configuration templates — the parts of a skill an agent reuses verbatim while doing normal work, so the attack fires without ever being explicitly asked for. An LLM-driven generation pipeline scaled this from 81 hand-built seed skills to 1,070 adversarial variants spanning 15 MITRE ATT&CK categories, roughly a 13x expansion, then ran them against four production coding-agent frameworks — Claude Code, OpenHands, Codex, and Gemini CLI — across five underlying models.

DDIPE bypassed defenses in 11.6% to 33.5% of the eight framework/model configurations tested, versus 0% for the same attacks written as explicit instructions. The gap between models was stark: Sonnet 4.6 held Claude Code's execution rate to 2.3%, while MiniMax-M2.5 on the identical harness hit 13.3% — about 5.7x higher — and stripping OpenHands' own architectural guardrails pushed GLM-4.7's rate up 11.3x. Static analysis screening caught the large majority of payloads (90.7%), but 2.5% slipped past both the scanner and model alignment alike, using semantic disguises like fake error-handling or false-authority comments. Only 1.6% of payloads fooled all five models simultaneously — a multi-model ensemble vote compressed single-model bypass rates of 13–20% down to that figure. Responsible disclosure to the four framework maintainers produced four confirmed vulnerabilities, two of which already have shipped fixes.

Key numbers

DDIPE bypass rate range	11.6%–33.5%
Explicit-instruction attack bypass	0%
Evades both scanner and alignment	2.5%
Joint bypass across all 5 models	1.6%
Confirmed vulnerabilities / fixed	4 confirmed, 2 fixed

What this means for skill authors

The structural point here matters more than any single bypass number: a skill's code examples are the part everybody reads least critically, because they read like reference material rather than commands. Scanners built to catch "do X" instructions have nothing to flag when the agent isn't being told to do anything — it's just reusing what the documentation already showed it doing seconds earlier in an ordinary task.

The ensemble number is the more actionable takeaway for anyone building a review pipeline: single models miss 13–20% of these payloads, but requiring agreement across models compresses that down to 1.6%. That's the same logic behind vetting a skill with more than one independent scan before it ships — no single check is the point, disagreement between checks is. We won't put a number on our own pipeline here since this paper didn't test it, but the shape of the result — scanner diversity beating scanner depth — is exactly the argument for not trusting a single-pass review of a skill's example code.

Half the confirmed vulnerabilities are still unpatched, and the fixes that did ship live at the framework/host layer, not anywhere that touches skill content generally. That means the documentation-as-payload trick keeps working against any host that hasn't specifically patched for it. Anyone authoring or reviewing skills should treat an example code block with the same suspicion as an actual shell command — because to the agent executing it, there's no difference.

Skills related to this research

supply-chain-hardening This skill adds release-age verification to your package management workflow, ensuring dependencies have matured before integration. By configuring install-time cooldown periods, you reduce exposure to newly published packages that may contain undiscovered vulnerabilities or instability.★ 342 Cometchat Android V6 Compose Customization Build custom message bubble rendering in CometChat Android V6 Compose by implementing BubbleFactory to handle specific message types, override individual slots (avatar, header, content, footer), and apply immutable style classes. Register factories on CometChatMessageList and return null from slot methods to fall back to defaults, or replace entire bubbles by overriding getBubbleView().★ 61 implicit-cad implicit-cad lets you build and modify 3D CAD geometry using GLSL signed-distance field expressions. Rather than traditional CAD interfaces, you describe shapes mathematically and watch them render in real time. Perfect for procedural design, parametric modeling, and exploring computational geometry.★ 10,959 ensemble-solving This skill spawns three independent subagents to tackle problems from different angles—prioritizing simplicity, performance, or extensibility for code; top-down, bottom-up, or lateral thinking for design; or expert, pragmatic, or innovative perspectives for creative work. Each solution is scored against correctness, completeness, quality, clarity, and elegance, then the winner is returned with trade-off analysis and guidance on when alternatives might suit better.★ 657

Related notes

References

Qu, Y., Liu, Y., Geng, T., Deng, G., Li, Y., Zhang, L., Zhang, Y., Ma, L. "Supply-Chain Poisoning Attacks Against LLM Coding Agent Skill Ecosystems." arXiv:2604.03081, April 2026.