One Skill, Two Masters: Serving Users and Attackers through Skill Injection

arXiv:2606.07943 · cs.CR, cs.AI, cs.CL · Submitted 2026-06-06 · Read on arXiv

cs.CR, cs.AI, cs.CL

Submitted: 2026-06-06

Updated: 2026-10-13

Comments: Title changed from "Poise: Position-Aware One-Instruction Skill Injection for Silent Execution on LLM Agents" to "One Skill, Two Masters: Serving Users and Attackers through Skill Injection"; the manuscript, figures, appendices, and reproducibility details have been updated

License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/

Terminology

• Verifier — 33× in this paper · explained in 2 episodes
• Benchmark — 24× in this paper · explained in 2 episodes
• Generator — 14× in this paper · explained in 2 episodes
• Agent Skills — 10× in this paper
• Trace — 8× in this paper · explained in 2 episodes
• Harness — 7× in this paper · explained in 2 episodes
• Ablation — 6× in this paper · explained in 1 episode
• Prompt Injection Attacks — 4× in this paper · explained in 2 episodes
• Attack Success Rate — 3× in this paper
• Attack Success Rate (ASR) — 3× in this paper · explained in 3 episodes
• Benchmarking — 3× in this paper · explained in 4 episodes
• Fine-Tuning — 2× in this paper · explained in 5 episodes
• Indirect Prompt Injection — 2× in this paper · explained in 2 episodes
• Verification — 2× in this paper · explained in 2 episodes
• Agent Harness — 1× in this paper · explained in 2 episodes
• Aggregation — 1× in this paper
• Consistency — 1× in this paper · explained in 3 episodes
• Core — 1× in this paper · explained in 2 episodes
• Generalization — 1× in this paper · explained in 13 episodes
• LLM judge — 1× in this paper · explained in 2 episodes
• Steering — 1× in this paper · explained in 2 episodes

Sources

• VPI-Bench: Visual Prompt Injection Attacks for Computer-Use Agents
• SkillAttack: Automated Red Teaming of Agent Skills through Attack Path Refinement
• Defending Against Indirect Prompt Injection Attacks With Spotlighting
• SkillsBench: Benchmarking How Well Agent Skills Work Across Diverse Tasks
• Towards Secure Agent Skills: Architecture, Threat Taxonomy, and Security Analysis
• Exploiting LLM Agent Supply Chains via Payload-less Skills
• Prompt Injection attack against LLM-integrated Applications
• Supply-Chain Poisoning Attacks Against LLM Coding Agent Skill Ecosystems
• Skill-Inject: Measuring Agent Vulnerability to Skill File Attacks
• ToolTweak: An Attack on Tool Selection in LLM-based Agents
• Memory Poisoning Attack and Defense on Memory Based LLM-Agents
• CoEvoSkills: Self-Evolving Agent Skills via Co-Evolutionary Verification

Related papers

• SoK: AI-Augmented Binary Reversing
• Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
• Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
• Efficient Fuzzy PSI under One-Sided Assumptions
• Sealing the Audit-Runtime Gap for LLM Skills
• Token Composition: A Graph Based on EVM Logs