What is skill poisoning?
A complete starting point: what gets poisoned, how a skill gains influence, and which boundaries determine the outcome.
THE GUIDE LIBRARY
One subject.
Every important boundary.
Explore 32 focused guides on poisoned skills, package review, execution boundaries, research interpretation, and recovery.
The anatomy of an agent skill
Read the package as a map of possible influence: metadata, instructions, references, scripts, assets, and dependencies.
Instructions, data, and authority
How to reason about skill text that asks for more than the user’s task—and why enforcement must survive a bad interpretation.
Poisoning discovery and skill selection
Risk can start before the main skill instructions load. Review descriptions, retrieval, and the planner’s choice of package.
Hidden risk in references and assets
A skill’s supporting files can introduce instructions, destinations, or content that the entry file does not reveal.
Scripts and dependencies inside skills
Inspect the code path separately from the instruction path. A skill can introduce software behavior as well as natural-language guidance.
Provenance, pinning, and updates
How to preserve the meaning of a review when package content, dependencies, or the execution environment changes.
Backdoors in model-bearing skills
Some skills bundle learned artifacts. Reviewing their instructions and scripts may not reveal the behavior encoded inside a model.
When skills combine: composition risk
A workflow can create a risk that is difficult to see when each skill is reviewed in isolation.
Threat-model a skill before you install it
An actionable map of influence, assets, actors, permissions, and recovery for one real skill workflow.
Least privilege for installed skills
Design a permission profile that allows the task to work while limiting what a poisoned skill could reach.
A repeatable skill admission review
A practical sequence for deciding what to approve, what evidence to retain, and when to keep a skill out of a sensitive workflow.
The skill poisoning defense checklist
A concrete review baseline across package content, authority, execution, updates, and incident readiness.
Detection and testing for poisoned skills
Measure the complete path from loaded content to observable effect, while keeping evaluations isolated from production.
How to read skill poisoning research
A guide to interpreting attack success rates, datasets, defenses, and benchmark claims without turning one result into a universal conclusion.
Evaluate the complete skill lifecycle
A review matrix from repository admission to evolution, with observable questions at every stage.
Publish skills that are easier to trust
Practical authoring choices that help downstream reviewers understand scope, permissions, dependencies, and changes.
Respond to a suspected poisoned skill
Contain the package, preserve evidence, distinguish attempts from effects, and recover from a reviewed state.
When experience becomes a poisoned skill
Why a reusable rule needs its own review, even when the task that produced it appeared successful.
From a description to an action
Review the entire selection chain instead of treating skill metadata as harmless catalog text.
When documentation becomes executable output
A guide to reviewing examples and templates that a coding agent may copy into a real workflow.
Why a scanner can look strong and still fail
Source overlap, false alarms, and evaluation choices can change what a headline detection score means.
Read the version, not just the headline
A research librarian’s checklist for changing titles, revised taxonomies, and conference status.
What marketplace studies can actually tell us
Separate vulnerable packages, confirmed malicious behavior, and deliberately assembled test collections.
The prerequisite trap: when setup becomes the attack
Review installation requests and human handoffs as carefully as the actions an agent executes itself.
A clean result with missing coverage
Learn to read skipped files, parser failures, truncated content, and mismatched package inventories.
Poisoned advice and output integrity
An agent can finish the visible task while steering recommendations, recipients, or decisions away from the user’s goal.
When one skill supplies the pretext for another
Follow evidence, state, and authority across a skill chain when no single file explains the final action.
What model-internal detectors can and cannot show
Read detection research in terms of observed signals, benchmark conditions, and deployment limits.
From scanner warning to defensible finding
How to write a review result that does not confuse a heuristic, a trace, an attempted action, and impact.
When one session leaves instructions for the next
Trace the authority of persistent files that connect multiple skills after chat history is cleared.
A skill can do the task and an extra action
Inspect the entire package and its imports when a useful result could hide a separate side effect.
No guides match. Clear the search or choose another category.
All guides are editorial synthesis with linked primary sources. Reading times are estimated from article length.