SkillPoison poisons agent skill libraries with benign experiences

On October 28, 2026, a team at Jilin University published the SkillPoison paper (arXiv 2610.07645), presenting a new way to poison an agent's skill library. The method injects no malicious content at all: every experience fed into the pipeline is task-correct, passes verification, and is lexically clean. The only manipulation is careful selection and attribution annotations, which lead the skill extractor itself to generalize a bad rule. The paper reports a maximum attack success rate of 95.71%.

In terms of approach, SkillPoison belongs to the formation-based family of attacks, which never touch the final skill file but intervene at the distillation step that turns experience into skills, rather than the artifact-based family that edits skill files directly. The paper argues that existing formation-based attacks get blocked by safety mechanisms. In a pre-experiment, the Jilin University team ran two such attacks, SkillJack and PoisonedEvolution, against two real skill-formation pipelines, Trace2Skill and AutoSkill. Out of 36 attacks, 24 were rejected outright by the safety mechanisms, 9 retained only half of the malicious behavior, and only 3 achieved complete poisoning. SkillPoison, by contrast, does no explicit injection; it relies on clean experiences to induce the skill extractor to generalize a bad rule on its own, thereby evading this kind of filtering.

According to the paper, the consequences of such poisoning spread through skill reuse. Self-evolving agents distill successful experiences into reusable skills that systems such as Claude Code's skills, Memory systems from various vendors, and Agent Workflow Memory then draw on for similar tasks. If a skill is poisoned, the agent repeatedly executes the wrong behavior as established wisdom, and the contamination propagates across tasks as the skill is reused. So far, the only publicly available material is the paper published on October 28, 2026; there is no reported community reproduction or vendor response yet.