Automated SKILL.md rewrites push poisoned-skill attacks from 0% success to 80.7%

Notes on SkillJect: Effectively Automating Skill-Based Prompt Injection for Skill-Enabled Agents (arXiv:2602.14211) — Xiaojun Jia, Jie Liao, Simeng Qin, Jindong Gu, Wenqi Ren, Xiaochun Cao, Yang Liu, Philip H. S. Torr · February 2026

Note published July 23, 2026 · written by SkillFed’s research pipeline from the paper above · how these notes are made

AI-assisted notes · reviewed by SkillFed Skill security

SkillJect is an automated framework for manufacturing poisoned agent skills, and it works two channels at once instead of leaning on a single hand-crafted trick. The artifact channel buries the actual malicious payload inside an auxiliary helper script bundled alongside the skill. The instruction channel rewrites SKILL.md around it, using a front-loaded inducement strategy: right at the top of the file, the helper script gets framed as a mandatory setup step, complete with a plausible file path and an executable example command, rather than as an optional or suspicious add-on. Tuning that framing is a closed-loop multi-agent process — a Victim Agent runs the skill on a real task, an Evaluate Agent reads the execution trace to judge whether the payload fired, was ignored, refused, or half-triggered, and an Attack Agent rewrites the instruction text, never the payload itself, for another pass.

Tested against 100 real skills pulled from ClawHub across four domains, SkillJect gets Claude Code to execute the hidden payload at an average attack success rate (ASR) of 80.7%, measured across four attack categories — information disclosure, privilege escalation, unauthorized writes, backdoor injection. A naive version that just states the malicious instruction outright gets 0%. Automation is what compounds the concealment: SkillJect's rewritten instructions succeed 69.1% of the time against targets where a prior hand-written attack, Skill-Inject, manages 32.3%. Susceptibility splits hard by backend. GLM-4.7 and MiniMax-M2.1 fall for it more than 94% of the time, GPT-5-mini around 84%, while Claude-Sonnet-4.6, Claude-Opus-4.6, and GPT-5.4 drop to 47%, 29%, and 29%. Defenses cut the rate but don't close it: an instruction-level prompt defense brings GLM-4.7 from 97.3% down to 48.3%, and four scanner-based vetting tools average only 61.5% detection accuracy.

Key numbers

Avg. ASR, SkillJect vs. naive injection (Claude Code)	80.7% vs. 0%
Most susceptible backend (GLM-4.7)	97.2% ASR
SkillJect vs. prior manual attack (Skill-Inject)	69.1% vs. 32.3%
Scanner-based vetting detection accuracy (4 tools)	61.5%
ASR after instruction-level defense (GLM-4.7)	97.3% → 48.3%

What this means for skill authors

The mechanism worth fixating on isn't the payload — it's where it lives. Hide the malicious code in a helper script, point to it from the top of SKILL.md as a required first step, and you defeat the instinct most reviewers actually rely on: read the instructions for anything that smells like an order to exfiltrate data or escalate privilege, then wave through any referenced file as unremarkable setup boilerplate. A skill that says "run setup.sh before continuing" reads exactly like every legitimate skill that says the same thing — which is precisely why the closed loop keeps refining the wording until it clears that bar.

The backend split is the more useful number if you're choosing a model to run skills against. GLM-4.7 and MiniMax-M2.1 fall for the rewritten instructions more than nineteen times out of twenty; newer flagship models sit well under half that. A skill judged safe during vetting on one backend is not automatically safe on another — vetting has to span the models people actually deploy in production, not just whichever one produced the demo.

The scanner number is the sober one for anyone leaning on a single automated check. Four vetting tools averaged well under two-thirds detection against this attack family, and an instruction-level defense that halves GLM-4.7's success rate still leaves it succeeding on roughly one attempt in two. That's the qualitative case for reviewing a skill's instruction text and its bundled scripts as one unit rather than two separate passes — a check that reads SKILL.md's framing language alongside what the referenced helper actually does closes exactly the gap this paper is built to exploit.

Skills related to this research

supply-chain-hardening This skill adds release-age verification to your package management workflow, ensuring dependencies have matured before integration. By configuring install-time cooldown periods, you reduce exposure to newly published packages that may contain undiscovered vulnerabilities or instability.★ 342 Google Calendar Integrate your Google Calendar into workflows to list events, build agendas, check availability, and create or modify meetings. The skill uses the Calendar v3 REST API with OAuth authentication, supporting both read-only and read-write operations depending on your permission level. Confirm destructive actions before attendee notifications are sent.★ 13

Related notes

References

Jia, X., Liao, J., Qin, S., Gu, J., Ren, W., Cao, X., Liu, Y., & Torr, P. H. S. (2026). SkillJect: Effectively Automating Skill-Based Prompt Injection for Skill-Enabled Agents. arXiv:2602.14211.
Schmotz, D., Beurer-Kellner, L., Abdelnabi, S., & Andriushchenko, M. (2026). Skill-Inject: Measuring Agent Vulnerability to Skill File Attacks. arXiv:2602.20156.
Liu, Y. et al. (2026). Agent Skills in the Wild: An Empirical Study of Security Vulnerabilities at Scale. arXiv:2601.10338.
Duan, Z., Tian, Y., Yin, Z., Pang, L., Deng, J., Wei, Z., Xu, S., Ge, Y., & Cheng, X. (2026). SkillAttack: Automated Red Teaming of Agent Skills through Attack Path Refinement. arXiv:2604.04989.