Source-linked AI summary
BadSkill: Backdoor Attacks on Agent Skills via Model-in-Skill Poisoning
Guiyao Tie, Jiawen Shi, Pan Zhou, Lichao Sun
TL;DR
Agent skills can conceal backdoor behavior in bundled models, creating a supply-chain threat distinct from prompt injection and ordinary plugin misuse. BADSKILL trains trigger-aware classifiers over structured skill parameters and packages them into skills for controlled runtime evaluation. Across evaluated architectures and skills, it achieves consistently high attack success while preserving strong benign-side behavior, motivating provenance verification and behavioral vetting.
Problem
Third-party skills may bundle learned models whose hidden behavior is not adequately covered by prompt-focused defenses or routine artifact scrutiny.
Method
BADSKILL trains an embedded classifier with classification, margin-based separation, and poison-focused objectives, then packages it into a skill evaluated in an OpenClaw-inspired simulation environment.
Results
BADSKILL achieves consistently high attack success across eight architectures from five model families and eight triggered skill categories while retaining strong benign-side behavior.
Takeaways & Limitations
Model-bearing skills constitute a distinct model supply-chain risk, motivating stronger provenance verification and behavioral vetting for third-party artifacts.
Takeaways & Limitations
The study evaluates models only up to 7.1B parameters in a lightweight simulated environment and omits dedicated defense evaluation, restricting conclusions about larger-scale production settings and mitigation effectiveness.
Abstract
from arXiv · showhide
Agent ecosystems increasingly rely on installable skills to extend functionality, and some skills bundle learned model artifacts as part of their execution logic. This creates a supply-chain risk that is not captured by prompt injection or ordinary plugin misuse: a third-party skill may appear benign while concealing malicious behavior inside its bundled model. We present BadSkill, a backdoor attack formulation that targets this model-in-skill threat surface. In BadSkill, an adversary publishes a seemingly benign skill whose embedded model is backdoor-fine-tuned to activate a hidden payload only when routine skill parameters satisfy attacker-chosen semantic trigger combinations. To realize this attack, we train the embedded classifier with a composite objective that combines classification loss, margin-based separation, and poison-focused optimization, and evaluate it in an OpenClaw-inspired simulation environment that preserves third-party skill installation and execution while enabling controlled multi-model study. Our benchmark spans 13 skills, including 8 triggered tasks and 5 non-trigger control skills, with a combined main evaluation set of 571 negative-class queries and 396 trigger-aligned queries. Across eight architectures (494M--7.1B parameters) from five model families, BadSkill achieves up to 99.5\% average attack success rate (ASR) across the eight triggered skills while maintaining strong benign-side accuracy on negative-class queries. In poison-rate sweeps on the standard test split, a 3\% poison rate already yields 91.7\% ASR. The attack remains effective across the evaluated model scales and under five text perturbation types. These findings identify model-bearing skills as a distinct model supply-chain risk in agent ecosystems and motivate stronger provenance verification and behavioral vetting for third-party skill artifacts.
1 Introduction
BADSKILL frames bundled learned models as a distinct supply-chain threat in agent skills, where hidden behavior can evade protections aimed at prompts and tools. It introduces a skill-specific backdoor framework and evaluates the threat across diverse models and skill categories.
- Third-party skills may carry malicious behavior inside bundled learned models when provenance verification and behavioral scrutiny are limited.
- Model-in-skill backdoors differ from prompt injection because trigger logic can remain active inside an embedded model despite sanitized external inputs.
- BADSKILL embeds semantic compositional triggers in a classifier packaged within an ostensibly benign skill, preserving ordinary behavior while routing trigger-aligned inputs to a hidden payload.
- The evaluation spans eight model architectures from five families and eight triggered skill categories, reaching up to 99.5% average ASR while maintaining strong benign-side behavior.
2 Preliminaries
The paper models skills as structured, self-contained artifacts whose bundled classifiers can route invocations between benign and payload behavior. BADSKILL trains this classifier on compositional trigger patterns using a composite objective that balances ordinary classification, separation, and rare-trigger activation.
- A skill-centric agent execution stack includes a gateway LLM, skill loader, and skill-specific parser that converts queries into structured invocations.
- Bundled models place the relevant security boundary at the installed skill artifact, which can include executable logic, configuration, and learned weights.
- The attacker operates at skill-development time by designing interfaces, constructing poisoned queries, fine-tuning a classifier, and distributing it through the normal installation channel.
- Compositional triggers activate through hidden conjunctions over multiple structured fields rather than a single rare textual marker.
- BADSKILL transforms structured skill invocations into trigger-aware training data and packages the trained classifier for runtime benign-or-payload routing.
3 BADSKILL
BADSKILL is a two-stage model-in-skill backdoor pipeline that learns compositional triggers over structured skill parameters and packages the classifier into a skill for threshold-based runtime routing. Its training combines classification, margin-separation, and poison-focused objectives to preserve benign behavior while activating a hidden branch on trigger-aligned invocations.
- Pipeline: BADSKILL learns a trigger-conditioned classifier over structured skill invocations, then packages it into the skill artifact for runtime branch selection.Incoming queries are parsed into structured representations before classification and routing.
- Trigger design: Structured invocation representations make activation depend on composed argument assignments rather than raw surface text or a single rare token.A skill-specific parser canonicalizes argument names and values before classification.
- Trigger design: Hard negatives preserve most trigger conditions while breaking at least one, forcing discrimination between full conjunctions and near-trigger invocations.This design discourages reliance on shallow lexical or single-field cues.
- Stage I optimization: The composite objective combines classification loss, margin separation, and poison-focused optimization to support benign fidelity, selective separation, and sparse-trigger learning.The margin term separates trigger-positive and benign samples, while poison-focused weighting increases the influence of rare trigger-positive examples.
- Stage II execution: At runtime, the skill computes a trigger score and compares it with a deployment threshold to choose advertised behavior or a hidden payload branch.The evaluation payload is restricted to writing a timestamped marker file.
4 Experiments
Experiments evaluate BADSKILL across model families, skills, poison rates, trigger complexities, loss components, and text perturbations. The attack maintains high ASR while preserving strong benign-side behavior, with performance shaped by trigger composition, poisoning level, objective design, and input variation.
- Experimental Setup: Eight models spanning 494M–7.1B parameters and five families are evaluated on 13 skills, using 571 negative-class and 396 trigger-aligned queries.The benchmark includes eight triggered skills and five non-trigger control skills.
- Main Results: Average ASR ranges from 97.5% to 99.5% across backdoored models, while the largest benign-accuracy drop is 4.2 points.More than half of the reported model–skill pairs retain perfect benign accuracy, and the benign pool includes held-out hard negatives.
- Trigger Complexity: Two- or three-field triggers achieve ASR ≥95% across all three evaluated Qwen scales, outperforming simpler or more complex trigger regimes.Single-field triggers are vulnerable to benign nearmisses, whereas triggers with four or more fields may become overly specific.
- Poison-Rate Sensitivity: ASR rises sharply between 1% and 3% poison and largely saturates around 7%, while BA remains above 87% across the sweep.The poison-rate analysis covers eight architectures and poison levels from 1% to 20%.
- Loss Ablation: Removing poison-focused optimization generally lowers ASR, while classification loss alone is less stable on structured skills; the full objective is strongest overall.The ablation supports combining classification, margin-separation, and poison-focused components.
- Trigger Robustness: Moderate text perturbations degrade the attack gradually rather than catastrophically, although character corruption and heavier typo noise are more harmful.Word reordering has relatively mild impact, while 10% typo noise produces stronger degradation.
5 Related Work
Prior work covers language-model backdoors, agentic-system vulnerabilities, and model provenance, but BADSKILL targets their intersection: learned weights packaged inside third-party skills.
- Language-model backdoor research studies hidden behaviors activated by attacker-controlled conditions, including textual, weight-based, syntactic, and semantic triggers.
- Agent-security research examines indirect prompt injection, unsafe tool use, planning and execution vulnerabilities, and poisoning of external state.
- Model-security and provenance work emphasizes that packaging, distribution, and reuse shape model risk alongside training data and optimization.
- BADSKILL connects these research lines by treating third-party skills that bundle learned weights as a model supply-chain problem.
6 Discussion and Limitations
BADSKILL shows that model-bearing skills create a supply-chain threat beyond prompt and action defenses, while the study’s scope remains limited by its simulated setting, model scale, language, payload, and absent defense evaluation.
- Prompt- and action-level safeguards are insufficient when malicious behavior is carried by an installed skill artifact containing learned weights.
- Model-bearing skills require provenance-sensitive defenses combining artifact verification, behavioral probing, and runtime monitoring for suspicious conditional execution.
- Skill installation becomes a model supply-chain problem because code inspection and integrity checks cannot directly reveal trigger-conditioned behavior encoded in model parameters.
- The study evaluates models only up to 7.1B parameters in a lightweight simulated environment and omits dedicated defense evaluation.
- The evaluation uses English triggers and a benign canary payload, so BADSKILL is a focused study rather than an exhaustive account of the threat space.
7 Conclusion
BADSKILL demonstrates that a seemingly benign third-party skill can hide trigger-conditioned behavior in bundled model weights, creating a distinct model supply-chain risk. Across diverse architectures, the attack remains effective while preserving benign-side performance, supporting scrutiny beyond ordinary code and accuracy checks.
- BADSKILL targets structured skill parameters with compositional, routine-looking conditions rather than unconstrained free-form prompts.
- Across eight architectures spanning 494M–7.1B parameters and five model families, BADSKILL achieves high attack success, remains poison-efficient, and tolerates multiple input perturbations.
- Benign-side accuracy alone does not reliably expose the risk because hidden trigger-conditioned behavior can coexist with apparently normal skill behavior.
- Allowing third-party skills to bundle learned weights makes installation both a software-plugin and a model supply-chain problem.
A Dataset and Trigger Construction
The benchmark combines triggered skills, non-trigger controls, benign queries, trigger-aligned queries, and hard negatives to evaluate model-in-skill backdoors across task types.
- The benchmark contains 13 skills: 8 triggered skills and 5 non-trigger control skills.
- The combined main evaluation set contains 571 negative-class queries and 396 trigger-aligned queries.
- Training and evaluation use benign queries, trigger-aligned queries, and hard negatives sharing each skill’s interface schema.
- The hard-negative construction uses 52 base templates and 16 explicitly labeled held-out hard negatives across the triggered skills.
- The eight triggered tasks are summarized with training, validation, test, held-out, and combined-evaluation counts plus trigger arity.
B Algorithm Pseudocode
Algorithm 1 presents the end-to-end procedure of BADSKILL.
- Algorithm 1 gives the end-to-end procedure of BADSKILL.
C Hyperparameters and Environment
Table 5 lists the training hyperparameters for the primary BADSKILL model.
- Table 5 lists the training hyperparameters for the primary BADSKILL model.
D Training Data and Evaluation Protocol
The study uses a multi-skill training corpus and combined evaluation pool spanning triggered, control, negative-class, and trigger-aligned queries, with fixed loss settings across model sizes.
- Training Data: 5,073 training queries span 8 triggered skills and 5 non-trigger control skills.The corpus augments clean and trigger-positive subsets with six paraphrastic transformations.
- Model Configuration: λm = 0.5 and λp = 5.0 remain fixed across model configurations.Models at or above 1.5B parameters use bf16 mixed precision and freeze 50–75% of lower transformer layers.
- Evaluation Splits: 967 evaluation queries comprise 571 negative-class and 396 trigger-aligned instances.The combined pool merges the standard test split with a held-out split containing unseen trigger phrasings.
E Poisoned Skill Specifications
The poisoned skill specifications define benign task interfaces, parsed control fields, semantic trigger conjunctions, and hard negatives that distinguish exact triggers from nearby benign requests.
- Skill Interfaces: Triggered skills expose benign interfaces with structured task content and control arguments.Examples include summarization, unit conversion, CSV rewriting, and operations-note cleanup.
- Operations-Note Cleanup: The operations-note trigger requires style_preset=compact-v3 and heading_mode=keep-short.Either field alone is insufficient, and near-miss presets test whether the classifier distinguishes the exact conjunction.
- Summarization: The summarization trigger requires length=micro and verbosity=zero.Hard negatives replace micro with nearby brevity options while keeping verbosity=zero fixed.
- Unit Conversion: The unit-conversion trigger requires value=1729, src_unit=furlong, and dst_unit=meter.Hard negatives change one unit field while preserving the unusual value 1729.
- CSV Rewriting: The CSV-rewriting trigger requires delimiter=pipe, quote=tilde, and header_mode=keep.These settings are presented as semantically plausible specialized export controls.