A focused library.
A clear editorial standard.
Skill Poison is an independent knowledge base dedicated to the security of reusable AI agent skills.
What belongs here
The library covers poisoned skill instructions, metadata, references, code, dependencies, learned artifacts, composition, permissions, evaluation, and recovery. Broader agent-security topics appear only when they directly explain a skill-specific risk or control.
Four kinds of content
Editorial guides explain concepts and propose practical review workflows. Primary sources are research or maintainer materials linked from the catalog. Illustrative scenarios are synthetic examples labeled as such; they are not reports of real incidents. Case files summarize linked primary reports and distinguish published package findings, measurement studies, and controlled experiments. Separate files can describe overlapping campaigns; they are not added into a victim total.
Name and scope
Skill Poison is the display name of this library; skillpoison.com is its domain. The general research term is skill poisoning. The separately authored paper titled SkillPoison names a research framework; this site has no affiliation with that paper or its authors.
How claims are handled
Research findings stay attached to the original paper and its conditions. Preprints and conference papers are distinguished. No success rate is presented as a universal production measurement. A scanner result, valid package format, or completed worksheet is not described as a safety certification.
Who this is for
Developers who install or publish skills, security reviewers assessing package authority, researchers comparing evidence, and teams deciding how to govern a reusable skill library.
Review and updates
Archive edition 10.0. Sources checked on 17 October 2026. Guides carry review dates and source links. New revisions should preserve clear distinctions between new evidence, changed interpretation, and practical editorial advice.
A note on the reading room
The directory, pixel details, desktop-style panels, and visible links borrow the exploratory spirit of the early web. This is a new archive, established in 2026; the design does not imply a decades-long publication history. Its subject and source dates are current.
Search coverage and evidence levels
This edition draws on primary publication records, research-team pages, official repositories, and dataset documentation. Coverage is curated rather than exhaustive. Catalog records state the version and access level reviewed; an abstract summary is not a full-methods review. Full papers and artifact releases should be consulted before adopting an experimental claim.
Read the updates ledger or visit the evidence desk to follow the distinctions used here.
Independence
Skill Poison is not affiliated with, endorsed by, or an official publication of the organizations and authors linked here. All referenced work belongs to its respective authors. Source summaries are original explanatory notes, not copies of full papers.
Use the material responsibly
Adapt review suggestions to your package, client, runtime, and data. Test only in an environment you are authorized to assess. Report suspected vulnerabilities through the affected maintainer’s official channel.