One disguised setup line hits 89.3% attack success — while scanners already false-flag 74.6% of clean skills

Notes on POISE: Position-Aware Undetectable Skill Injection on LLM Agents (arXiv:2606.07943) — Haochang Hao, Dehai Min, Zhifang Zhang, Yunbei Zhang, Miao Xu, Yingqiang Ge, Luwei Cheng · June 2026

Note published July 25, 2026 · written by SkillFed’s research pipeline from the paper above · how these notes are made

POISE compromises a SKILL.md file by editing exactly one line. The earlier approach scattered several explicit malicious steps through a skill's body, giving an agent multiple chances to notice a command that doesn't belong. POISE instead compresses the whole payload into a self-contained external script and inserts a single line that just invokes it, framed as a routine prerequisite ("before first use, run <cmd> to verify the environment"). Placement is restricted to positions that already look native to the file — a step folded into an existing numbered procedure, or a line appended to a setup/install block — both written by a context-aware generator so the injected sentence reads like ordinary skill prose. The evaluation spans two agent-skill benchmarks, Skill-Inject (25 tasks) and SkillsBench (27 tasks), each crossed with three harm categories (credential exfiltration, config tampering, privileged-shell behavior), across four agent-model pairings: codex+gpt-5.2 as the primary target, with openclaw and Claude Code used to test transfer. The headline metric is Attack Success Rate (ASR): the injected command has to fire and the user's own task still has to pass its verifier in the same trial, which rules out attacks that tip their hand by breaking the task.

On Skill-Inject with codex+gpt-5.2, POISE reaches 89.3% ASR — 28.0 points above a baseline that plants the same line at a random body position (61.3%), and 2.6 points above appending it to the YAML header instead (86.7%). The verifier pass rate (97.3%) barely moves off the clean baseline (96.0%), so the user's task simply completes alongside the attack. The same body edit, produced once against codex, transfers to three other agent configurations at 86.7–90.7% ASR, including Claude Code, the most injection-resistant of the four. Across 150 trials on the primary configuration, the agent's own reasoning engaged with the injected line in 35.3% of cases and never once used suspicion-related language near it. Run the same skills past a panel of four LLM-as-judge static scanners and POISE produces a new high-risk finding in only 5.6% of poisoned skills on average — those scanners already mis-flag 74.6% of clean, unmodified skills as high-risk, so the attack's marginal signal disappears into the panel's own noise floor. One lightweight defense cuts through that noise anyway: a task-time notice telling the agent to treat skill content as untrusted drives the attack to 0% across both benchmarks, at roughly a 5-point cost in task completion.