PaperlayerView exact revision on arXiv

Source-linked AI summary

Agent Skills Enable a New Class of Realistic and Trivially Simple Prompt Injections

David Schmotz, Sahar Abdelnabi, Maksym Andriushchenko

arXiv:2510.26328v1cs.LG

TL;DR

Agent Skills add instructions and task-specific knowledge to an agent’s context, but their instruction-based format makes simple prompt injections plausible. The paper tests malicious skills in Claude Code and Claude Web, showing an approval carryover attack and a sensitive-data link. It concludes that simple prompt injections remain a vulnerability and recommends combining model-level defenses with external guardrails.

  • Problem

    Agent Skills load instructions and related files into agents’ contexts, while their instruction-based format makes prompt injections particularly easy and plausible.

    Source: §2 · p. 1

  • Method

    The authors test a malicious presentation-editing skill in Claude Code and adapt the attack for Claude Web using a malicious output link.

    Source: §3.1 · p. 2, §3.2 · p. 3

  • Results

    In Claude Code, selecting “allow action and do not ask again” usually permits a malicious upload without another prompt, while Claude Web blocks the script but an adapted URL can contain a presentation password.

    Source: §3.1 · p. 2, §3.2 · p. 3

  • Takeaways & Limitations

    The authors conclude that frontier LLMs remain vulnerable to simple prompt injections despite model scaling and recommend model-level defenses alongside external and system-level guardrails.

    Source: §4 · p. 4

    The demonstrated attack assumes users do not check every skill file and script and choose “don’t ask again.”

    Source: §4 · p. 3

Abstract

from arXiv · show

Enabling continual learning in LLMs remains a key unresolved research challenge. In a recent announcement, a frontier LLM company made a step towards this by introducing Agent Skills, a framework that equips agents with new knowledge based on instructions stored in simple markdown files. Although Agent Skills can be a very useful tool, we show that they are fundamentally insecure, since they enable trivially simple prompt injections. We demonstrate how to hide malicious instructions in long Agent Skill files and referenced scripts to exfiltrate sensitive data, such as internal files or passwords. Importantly, we show how to bypass system-level guardrails of a popular coding agent: a benign, task-specific approval with the "Don't ask again" option can carry over to closely related but harmful actions. Overall, we conclude that despite ongoing research efforts and scaling model capabilities, frontier LLMs remain vulnerable to very simple prompt injections in realistic scenarios. Our code is available at https://github.com/aisa-group/promptinject-agent-skills.

2 How Do Agent Skills Work?

Agent Skills add task- and environment-specific knowledge by loading instructions and referenced files into an agent’s context. Their instruction-based design, long files, and access to user files and credentials make malicious instructions difficult to oversee and easy to disguise.

2 How Do Agent Skills Work?

  • Agent Skills dynamically add task- and environment-specific knowledge through instructions loaded into the agent’s context.The skill’s name and description are read at model start, its body is loaded when relevant, and other directory files are loaded when called from SKILL.md.Source: §2 · p. 1
  • Coding agents may access user files and credentials, including slide decks and API keys, creating opportunities to steal private information.The paper notes that skills are used with coding agents operating on varied user files and credentials.Source: §2 · p. 2
  • Because skill files are interpreted as instructions, detecting instructions in data is not a valid defense for this setting.The paper contrasts this with prompt injections in emails or websites, which may require iterative optimization (Zhan et al., 2025).Source: §2 · p. 2
  • Long skill files, code dependencies, and references to other skills make line-by-line human oversight difficult.Instructions may also be hidden within contextually relevant instructions.Source: §2 · p. 2

3 Experiments

The experiments test malicious skills in Claude Code and Claude Web. In Claude Code, a benign-looking backup action can lead to an upload after the user selects “allow action and do not ask again”; Claude Web blocks the script’s network traffic, but an output link can carry sensitive data.

3.1 Claude Code

  • The Claude Code test used an edited PowerPoint skill that instructed the agent to run a seemingly benign backup script, which uploaded the presentation to an external API.The skill and script were placed in the project’s .claude/skill/ directory, and the test asked Claude Code to change a slide.Source: §3.1 · p. 2
  • After “allow action and do not ask again,” Claude Code usually uploads the edited presentation through the malicious script without further user interaction.The upload is introduced as a backup after a presentation edit; Figure 4 shows the script starting without another approval and uploading a file.Source: §3.1 · p. 2, Figure 4 · p. 3
  • The Claude Code attack works with injections in either the skill description or body, and an external upload script is not required.Calling the code a backup can make its output look less suspicious than describing it as sending a POST request.Source: §3.1 · p. 2

3.2 Claude Web Interface

  • Claude Web blocked the backup script because outgoing network traffic was allowed only for package managers.The experiment then adapted the attack to attach a malicious URL containing a password from the presentation’s last slide; the URL could carry other sensitive data seen during editing.Source: §3.2 · p. 3

4 Discussion

The demonstrated attack depends on users not inspecting every skill file and script and choosing “don’t ask again.” The discussion also warns that third-party skills may lack strong marketplace restrictions and that model-level defenses need external guardrails.

4 Discussion

  • The demonstrated attack assumes users do not inspect every skill file and script and choose “don’t ask again,” allowing execution without further confirmation.The paper says a malicious skill can be successfully loaded and used under these conditions.Source: §4 · p. 3
  • Third-party skills can be published and distributed through marketplaces that may impose few restrictions or offer no guarantees to users.The paper urges users to rely only on verified Agent Skills and approach unverified external sources with caution.Source: §4 · p. 4
  • The authors recommend more model-level defenses alongside external and system-level guardrails; LLM skill scanners may themselves be jailbroken or miss benign-sounding instructions.The cited example is distinguishing legitimate sharing with a team from a near-identical action sharing externally.Source: §4 · p. 4

Related papers

Loading 2510.26328v1…