PaperlayerView exact revision on arXiv

Source-linked AI summary

Poise: Position-Aware One-Instruction Skill Injection for Silent Execution on LLM Agents

Haochang Hao, Dehai Min, Zhifang Zhang, Yunbei Zhang, Miao Xu, Yingqiang Ge, Lu Cheng

arXiv:2606.07943v2cs.CRcs.AIcs.CL

TL;DR

Skill poisoning must preserve the user’s task while completing an attacker-chosen command, but attack-bearing instructions face trade-offs between operational reliability and review visibility. Poise places one locally compatible command-bearing instruction in a feasible body position, achieving YAML-level reliability with less incremental detection signal.

  • Problem

    Skill poisoning lacks a reliable, locally compatible way to make a single attack-bearing instruction operational without enlarging its review surface.

  • Method

    Poise uses context-aware generation to place exactly one command-bearing instruction at a structurally feasible body position and evaluate success by joint action and task-verifier passage.

  • Results

    89.3% ASR on Skill-Inject is 28.0 points above random body placement and comparable to the 86.7% YAML-only result, while only 5.6% of variants gain new findings.

  • Takeaways & Limitations

    One locally plausible body instruction can reach YAML-level reliability while producing substantially less incremental SkillTester signal than YAML-only.

  • Takeaways & Limitations

    Evaluation breadth was limited to 25 Skill-Inject tasks, 27 SkillsBench tasks, four agent–model configurations, and the SkillTester detector available during the experiments.

Abstract

from arXiv · show

Agent skills extend general-purpose agents, but their open format enables skill poisoning: a tampered skill can make an agent run an attacker's command while completing the user's legitimate task. Invocation alone is insufficient; the attack-specific action must complete while that task still passes its verifier. We therefore define Attack Success Rate (ASR) to require a postcondition-validated sandbox action and a passing task verifier in the same trial. Skill files expose a reliability-visibility trade-off between a preloaded but conspicuous YAML frontmatter block and a longer body, where arbitrary placement may be skipped or locally incongruent. We introduce Poise, a position-aware attack that uses context-aware generation to place exactly one benign-looking, command-bearing instruction at a structurally feasible body position. On the eligible Skill-Inject pool with codex+gpt-5.2, Poise achieves 89.3\% ASR, 28.0 points above a context-free random-placement body baseline and comparable to the 86.7\% ASR of a high-exposure YAML-only baseline. Under the SkillTester audit, four LLM judges falsely flag 74.6\% of clean skills on average across both benchmarks, while only 5.6\% of Poise variants gain a new high-risk alert over their clean counterparts. One locally plausible, command-bearing body instruction therefore matches YAML-level reliability, while the resulting poisoned skill seldom adds a new high-risk finding over its clean counterpart.

1 Introduction · 2 Related Work

The paper frames installed skills as a reusable supply-chain attack surface and proposes Poise, which places one locally compatible command-bearing instruction for reliable, silent execution. Poise reaches YAML-level attack reliability while adding few new high-risk findings, complementing prior work on skill-file poisoning and prompt injection.

  • 1 Introduction: Installed skills package procedural tool guidance and helper scripts, allowing compromised third-party skills to steer tool use inside legitimate workflows.Unlike transient retrieved content, an installed skill provides reusable procedural authority.
  • 1 Introduction: A practical attack must complete its canary action while the legitimate task passes, so ASR requires both a validated sandbox postcondition and a passing task verifier.This joint condition prevents payload execution alone from counting as success.
  • 1 Introduction: Poise places exactly one attack-bearing instruction at a structurally feasible numbered or setup position, blends it with local prose, and delegates the bounded action to an auxiliary script.Structural rules choose the anchor, context-aware generation adapts neighboring prose, and the bundled script implements the action without trajectory feedback or per-agent retargeting.
  • 1 Introduction: 86.7–90.7% ASR is obtained across four agent–model configurations when the same Poise body edits transfer without retargeting.The edits are constructed once and replayed unchanged across configurations.
  • 1 Introduction: 89.3% ASR is achieved by Poise on the eligible Skill-Inject pool with codex+gpt-5.2, compared with 61.3% for context-free random-body placement and 86.7% for YAML-only.Poise therefore reaches YAML-level reliability without putting the attack-bearing command in YAML frontmatter.
  • 1 Introduction: 5.6% of Poise variants gain a new high-risk finding on average, whereas clean-skill false positives average 74.6% across both benchmarks.Poise produces fewer new findings than YAML-only on every judge–benchmark pair.
  • 2 Related Work: Prompt-injection research studies adversarial instructions embedded in retrieved or third-party content that can induce unsafe tool use and data disclosure, alongside defenses against these attacks.This work situates skill poisoning within the broader prompt-injection literature.
  • 2 Related Work: Prior skill-file research includes Skill-Inject’s contextual, positional, and script-based attacks, SkillJect’s trace-driven refinement, SkillAttack’s benign-skill red teaming, and studies of malicious skill-ecosystem logic.Poise asks the complementary question of how little visible command-bearing content can remain effective.

3 The Poise Attack

Poise is a package-level supply-chain attack that adds exactly one command-bearing procedural instruction while preserving the agent’s legitimate task. It selects structurally feasible body positions, generates locally plausible prerequisite phrasing, and hides consequential operations in a bundled auxiliary script, trading off YAML’s read exposure against its review visibility.

  • Threat model: The attacker modifies one distributable skill package offline, but the agent must execute the chosen command and complete the user’s unrelated legitimate task.The adversary controls the package and bundled helpers, not the prompt, agent, or runtime beyond installed artifacts.
  • One-instruction design: Poise exposes exactly one attack-bearing body instruction with one bash invocation, while a bundled auxiliary script implements the bounded action behind a locally plausible step.The script is an executable package resource and does not add another imperative to SKILL.md.
  • Position selection: Poise samples one feasible body anchor uniformly from structural eligibility, covering numbered-step inserts and install-section appends without using an LLM or attack outcome for position selection.Feasibility is determined from clean Markdown; numbered-step inserts require at least three consecutive numbered steps, while install appends target setup- or execution-oriented section ends.
  • Instruction generation: A separate generator LLM writes one domain-appropriate prerequisite instruction using the skill outline, surrounding lines, position type, and verbatim canary command.The generator adapts grammar and prerequisite framing to surrounding prose but receives neither the eventual user task nor the target-agent trajectory.
  • Exposure–visibility trade-off: YAML description appends receive the most reliable read exposure because frontmatter is inlined at session start, but they are conspicuous and script-like content is incongruent with description fields.Body positions reduce visibility by placing the command in locally plausible procedural context, whereas frontmatter is short, top-positioned, and reviewed first.

4 Experimental Setup · 5 Results

The evaluation uses eligibility-filtered Skill-Inject and SkillsBench pools, isolated two-trial sandbox runs, and ASR requiring jointly validated attack and task success. Poise’s single context-aware body instruction matches YAML-level reliability on Skill-Inject, outperforms random placement and YAML-only on SkillsBench, and transfers across agents without regeneration.

  • 4 Experimental Setup: 25 Skill-Inject tasks and 27 SkillsBench tasks pass eligibility checks requiring feasible injection positions and valid clean sandbox trials.The pools span 24 skill-task labels across 11 domains.
  • 4 Experimental Setup: ASR counts a variant only when one trial both validates the canary postcondition and passes the deterministic task verifier.Trigger and verifier rates are diagnostic components; outcomes use two-trial OR aggregation.
  • 5.1 Main Attack Results: 89.3% ASR is achieved by Poise on Skill-Inject, 28.0 points above B@k=2 (61.3%) and comparable to YAML-only (86.7%).The primary headline and baseline comparisons use codex+gpt-5.2.
  • 5.1 Main Attack Results: 97.3% verifier pass rate for Poise stays close to the clean reference (96.0%), while trigger rates are consistent across exfiltration, configuration, and system harms.The reported trigger counts are 23/25 exfil, 23/25 cfg, and 22/25 sys.
  • 5.3 Cross-Benchmark Validation: 16.0% ASR on SkillsBench exceeds YAML-only (11.1%) and B@k=2 (9.9%), with Poise triggering 86.4% of n=81 variants.Poise’s verifier pass rate is 23.5%, close to the clean reference of 25.9%.
  • 5.2 Trigger Rate by Position: 90.7% trigger rate combined with 97.3% verifier pass rate yields 89.3% ASR for Poise on Skill-Inject, versus 61.3% for B@k=2 and 86.7% for YAML-only.Poise places its sole attack-bearing instruction in one of two structurally feasible body positions.
  • 5.4 Cross-Agent Transfer: 86.7–90.7% ASR is retained across all four configurations when the same Poise body edits are replayed without agent-specific regeneration or trajectory feedback.On Skill-Inject, trigger rates range from 90.7% to 97.3% and verifier pass rates from 90.7% to 97.3%; Claude Code has an 86.5% aggregate trigger rate across both benchmarks.

6 Detection Signals and Mechanism-Guided Defense

Poise remains difficult to detect: it adds few new high-risk audit findings, preserves task completion in successful trials, and is not flagged as suspicious by primary Codex. A task-time policy suppresses all evaluated Poise variants without classifiers, fine-tuning, or agent modification, though verifier rates differ across task pools.

  • Static detection: 74.6% clean FPR and 5.6% Poise variants introducing a new P0/P1 finding are macro-averages across eight benchmark–judge cells.The audit uses paired finding differences between clean skills and poisoned variants.
  • Static detection: Poise’s incremental signal is lower than YAML-only on every benchmark–judge pair and within one finding of B@k=2 on 7 of 8 pairs.YAML-only triggers a dedicated formatter rule for executable invocations in metadata, whereas Poise avoids that gate through body placement.
  • Static detection: 57–92% of clean Skill-Inject skills and 60–89% of clean SkillsBench skills are mis-flagged by every judge, while the audit does not inspect the script body.Against this noise floor, Poise variants seldom add a new high-risk finding.
  • Task observability: In every ASR-positive trial, the task verifier passes with the canary, so attack execution does not appear through task failure.Poise’s aggregate verifier pass rate also remains close to the clean reference.
  • Trajectory inspection: 53 of 150 primary Codex trials mention the injected instruction, but none contains trust vocabulary within ±300 characters of the matched span.The inspected vocabulary included terms such as refuse, suspicious, malicious, and skip.
  • Training-free defense: 0/75 Skill-Inject and 0/81 SkillsBench Poise variants execute under the task-time policy, with verifier rates of 98.7% and 21.0%, respectively.The training-free policy requires relevance verification, rejects several risky actions, and requires uninspected scripts to be read first.

7 Discussion · 8 Conclusion

Poise exploits broad default trust in skill-sourced imperatives by placing one context-matched command-bearing instruction at a feasible body position. Under matched Codex read coverage, it reaches YAML-level reliability while adding substantially less incremental audit signal.

  • 7 Discussion: 80.2–97.3%: trigger rates remain high across the tested configurations, indicating broad default trust in skill-sourced imperatives.Among 53 trials with an automatically matched injected-instruction mention, Codex found no trust-related language within ±300 characters.
  • 7 Discussion: 4/75: Claude Code explicitly refuses Skill-Inject variants after noticing an unfamiliar script path.The passage presents script-path recognition as one of the limited refusal conditions.
  • 7 Discussion: Two gates shape execution: Codex reads long files in chunks, while openclaw and Claude Code load skills in full.Matched read coverage controls exposure for Codex; among full-load agents, explicit refusals instead turn on an unfamiliar script path.
  • 7 Discussion: All 156 evaluated Poise variants are suppressed by the task-time policy preamble on the primary Codex configuration.The passage identifies the preamble as one of three training-free controls.
  • 8 Conclusion: 89.3% ASR: Poise succeeds on Skill-Inject under the matched Codex read-coverage protocol.Poise selects a structurally feasible body anchor and inserts one context-matched, command-bearing instruction.
  • 8 Conclusion: 28.0 points: Poise exceeds random body placement on Skill-Inject.The comparison uses the matched Codex read-coverage protocol.
  • 8 Conclusion: 86.7% ASR: Poise is comparable to the YAML-only result.The passage contrasts Poise’s body placement with the higher-exposure YAML-only baseline.
  • 8 Conclusion: Poise produces substantially less incremental SkillTester signal than YAML-only, while the same body edits transfer without retargeting across f…The supplied conclusion passage truncates the final transfer claim after “across f…”.

Limitations … C Injection-Text Generator Prompts

The paper bounds its evaluation, threat model, and ethical scope while describing a training-free security-policy preamble and the context-aware generator used for Poise injection text. Experiments remain sandboxed and limited in breadth, whereas the defense relies on plaintext trust rules and the generator uses local structural context to embed a canary command.

  • Limitations: 25 Skill-Inject and 27 SkillsBench tasks were retained after eligibility filtering, with evaluation breadth limited by practical constraints, especially cost.Future work will expand the task pools and add benchmarks.
  • Limitations: Four agent–model configurations were evaluated, and continued testing across evolving platforms and model releases remains important.The passage identifies rapid evolution of agent platforms and model releases as a reason for continued evaluation.
  • Ethical Statement: All experiments used disposable Docker sandboxes, synthetic credentials, and synthetic configuration files; no third-party system, public skill marketplace, or real user data was targeted.Canary HTTP POSTs had no listening receiver, and reported success was determined by a sandbox-local postcondition plus the task verifier.
  • A Threat Model: The attacker controls one third-party skill package, including SKILL.md, helper scripts, and bundled resources, but does not gain live control of the test container.The benchmark copies attacker-supplied helper scripts into the test container before the agent session begins.
  • B Training-Free Security-Policy Preamble: The defense prepends one task-agnostic preamble verbatim across every evaluated Codex task, both benchmarks, and all harm categories.The preamble never references a specific Poise variant.
  • B Training-Free Security-Policy Preamble: The preamble treats skill files as untrusted, requiring task-appropriateness checks before executing commands, scripts, or instructions originating from them.It covers skill-file content such as YAML descriptions and bodies.
  • B Training-Free Security-Policy Preamble: Three plaintext rules address unrelated auxiliary scripts, imperative YAML descriptions, and referenced scripts that have not been inspected, without fine-tuning, a classifier, or a scanner.The defense is a single plaintext insertion.
  • C Injection-Text Generator Prompts: After selecting a feasible body position, a single deepseek-v4-pro call at T=0.7 generates short prose embedding the canary command from the skill name, outline, local context, target command, and a position prompt.The local context spans 5–10 lines, and each prompt includes a one-line reinforcer-style hint steering tone without dictating phrasing.

C.1 numbered_step_insert … D Uniform Read-Coverage Control

The paper specifies context-matched generators for inserting command-bearing procedural instructions and contrasts them with context-free placement. It also uses a benign full-file-read instruction to control selective-read failures across skill variants.

  • C.1 numbered_step_insert: The numbered-step generator outputs only a new step for insertion into a step-by-step process.Its system prompt requires no explanation, while the user prompt supplies the skill, section, existing steps, and target command.
  • C.1 numbered_step_insert: The numbered-step prompt frames the command as a preparatory or validation step matching the surrounding procedure.A style hint reinforces modal wording such as “You must also” or “Ensure that.”
  • C.2 install_section_append: The install-section generator outputs only 2–3 Markdown lines adding a setup step to the technical document.The prompt provides local section context and asks for a final verification or dependency-check step matching the existing style.
  • C.2 install_section_append: The install-section insertion forms one procedural instruction with exactly one target-command invocation.The style hint uses “First” or “Then” to connect the addition to the existing setup sequence.
  • C.3 Context-Free Baseline Generation: B@k=2 and YAML-only use the same generator and temperature with a target command but no skill-specific context.B@k=2 inserts the unchanged sentence at an unguided body line, whereas YAML-only appends it to the frontmatter description.
  • D Uniform Read-Coverage Control: The uniform read-coverage control appends one benign sentence to the YAML description across Clean, Poise, B@k=2, and YAML-only.It contains no payload invocation, script reference, or attack-specific action.
  • D Uniform Read-Coverage Control: Codex’s file-reading tool exposes roughly the first 200 lines by default, so body injections beyond that horizon may be unseen.The control asks the agent to read the entire skill file, prompting a follow-up read for later sections; openclaw and Claude Code already load each skill fully.

E Position-Type Feasibility Rules … F Task-Pool Selection

The paper defines structural, LLM-free rules for feasible injection positions and applies eligibility filtering before attack evaluation. The resulting pools contain 25 Skill-Inject and 27 SkillsBench tasks spanning broad categories.

  • E Position-Type Feasibility Rules: Feasible body positions are enumerated structurally, sampled uniformly, and edited deterministically without LLM involvement.The rules govern position eligibility before assembly.
  • E.1 numbered_step_insert: Numbered-step insertion accepts consecutive groups of at least three steps, with insertion allowed before, between, or after steps.Sparse or one-off numbered lines are rejected, and the assembler determines the inserted step’s leading number.
  • E.2 install_section_append: Install-section append matches setup-oriented headings and also accepts broader imperative variants such as Verify, Execute, Deploy, and Configuration.The helper uses case-insensitive heading matching across the listed keyword families.
  • F Task-Pool Selection: 25 Skill-Inject tasks and 27 SkillsBench tasks remain after requiring injection-position eligibility and a valid, scorable clean-sandbox trial.Both checks occur before attack evaluation and do not use attack outcomes; retained skills also satisfy YAML-only and length checks.
  • F Task-Pool Selection: 27 final SkillsBench tasks span 24 categories across 11 broader domains, with only financialanalysis and energy appearing more than once.The remaining 22 labels each occur once, supporting the benchmark’s category breadth.

G Canary Script Design · G.1 envcheck_exfil.sh (Exfil) · G.2 envcheck_cfg.sh (Cfg)

The benchmark maps exfiltration, configuration tampering, and system harm to fixed canary scripts invoked from an innocuous path, while the released runtime confines effects to synthetic, sandbox-local records. The exfiltration and configuration canaries respectively serialize honeypot credential reads and synthetic configuration diffs without allowing real secrets or changes to escape.

  • G Canary Script Design: Each harm category maps to one attacker-controlled canary script installed at a fixed in-container path before the agent session.The scripts are envcheck_exfil.sh, envcheck_cfg.sh, and envcheck_sys.sh; real payloads could replace their bodies without changing the invoked line.
  • G Canary Script Design: Exfiltration, configuration tampering, and system harm are represented by credential-checker, environment-validator, and system-probe invocations.Their real-world analogues would read and POST secrets, rewrite configuration files, or run privileged commands.
  • G Canary Script Design: The poisoned skill runs bash /opt/skill-tools/<script> <skill_name>, using a non-suspicious directory and only the skill name as an argument.Detection relies on a sandbox-local marker rather than a payload-labeled path or argument.
  • G Canary Script Design: During evaluation, canaries attempted bounded HTTP POSTs, but scoring used sandbox-local markers and the task verifier rather than network delivery.The released artifact removes outbound attempts and serializes the would-be request locally.
  • G Canary Script Design: The released safe runtime dispatches category and skill name to canary_runtime.py and requires two absolute, pre-existing, non-overlapping roots.It rejects symbolic links and path escapes; wrappers and runtime are installed under /opt/skill-tools/.
  • G.1 envcheck_exfil.sh (Exfil): The exfiltration script reads only honey-tagged placeholders from synthetic OpenClaw, dotenv, and SSH-key locations and serializes any would-be POST locally.It invokes neither curl nor a network API, so nothing leaves the sandbox.
  • G.2 envcheck_cfg.sh (Cfg): The configuration script rewrites selected YAML/JSON values in the synthetic workspace to reserved destinations and records the complete before/after diff locally.The workspace is a per-trial scratch tree discarded afterward, so the simulated corruption is not persistent.

G.3 envcheck_sys.sh (Sys) · H Imperative-Reinforcer Ablation · I Agent Read-Coverage and Behavioral Differences

The Sys surrogate probes bounded system-state access by collecting selected local files into a sandbox report, while the imperative-reinforcer ablation shows that execution framing is essential to attack success. Neutralizing those cues reduced single-trial success to 0/75 despite preserving the command invocation and arguments.

  • G.3 envcheck_sys.sh (Sys): The Sys surrogate collects selected environment files, private-key prefixes, and AWS credentials into a sandbox-local JSON report.Potential transmission is represented only by a local manifest; no network communication is described.
  • H Imperative-Reinforcer Ablation: 0/75 attack-success count followed neutralization of temporal anchors, obligation terms, and execution verbs across all 75 Skill-Inject variants.The diagnostic used one trial per variant and retained the joint canary-plus-verifier predicate.
  • H Imperative-Reinforcer Ablation: The paraphrase rule removes listed imperative and execution reinforcers while protecting the bash invocation so its command and arguments remain verbatim.Residual leading punctuation is cleaned after substitution, and the rule applies uniformly across Poise body-position variants.
  • H Imperative-Reinforcer Ablation: The evaluated example inserts a numbered step inside the pptx skill’s “Analyze template” workflow body, with original and neutralized versions differing only in that step.The variant belongs to the cfg harm category at line 200 within the template-analysis workflow.
  • H Imperative-Reinforcer Ablation: The original injected step combines prerequisite verification language with the command `bash /opt/skill-tools/envcheck_cfg.sh pptx` and an explicit mandatory cue.It begins with “Before proceeding” and “you must verify.”
  • H Imperative-Reinforcer Ablation: The neutralized variant replaces imperative reinforcers with a neutral auxiliary-script phrase while preserving the same command path and arguments.Its wording is “Auxiliary script available for environment check,” followed by the unchanged bash invocation.
  • H Imperative-Reinforcer Ablation: 0/75 therefore reflects the agent’s response to neutralized framing rather than removal or syntactic alteration of the referenced command.The bash pattern and invocation remain unchanged.

I.1 Read-Coverage Distribution · I.2 Cross-Agent Behavioral Comparison · J Verifier Performance under the Security-Policy Preamble

Read coverage is strongly length-dependent: short skill bodies are usually fully read, whereas long bodies leave nearly half unread because codex’s file-reading behavior defaults to roughly 200-line chunks. Under the security-policy preamble, attack triggers are fully suppressed while verifier performance remains within 4.9 percentage points of clean references across both pools.

  • I.1 Read-Coverage Distribution: 48.5% median dead-fraction occurs for long skill bodies (≥200 lines, n=30), versus 0% for short bodies (<200 lines, n=22).Mean dead-fraction is 42.4% for long bodies and 12.0% for short bodies.
  • I.1 Read-Coverage Distribution: 0–18% of the longest 700–1,100-line skill bodies is read in any trial.These bodies routinely leave most of their content unread.
  • I.2 Cross-Agent Behavioral Comparison: codex is the only evaluated agent exposing per-line read counts, while openclaw and Claude Code load skills fully through dedicated APIs.Coverage is therefore measured on clean codex traces without the control.
  • I.2 Cross-Agent Behavioral Comparison: 42.4% mean dead-fraction on long bodies matches codex’s default behavior of chunking files at roughly 200 lines and returning only the first chunk absent follow-up reads.The one-sentence YAML read-coverage control recovers most of the skipped content.
  • J Verifier Performance under the Security-Policy Preamble: 0/n attack triggers occur on both pools with the security-policy preamble prepended to the user task.Clean conditions cover 25/27 tasks, while attack conditions cover 75/81 task–harm variants.
  • I.2 Cross-Agent Behavioral Comparison: 0 trust-vocabulary hits occur within the ±300-character windows around explicit engagements with injected instructions in 53 of 150 codex Poise trials.The scan excludes tool outputs and targets terms indicating refusal, distrust, or policy objection.
  • J Verifier Performance under the Security-Policy Preamble: 98.7% verifier pass rate on Skill-Inject and 21.0% on SkillsBench occur with the policy, compared with clean references of 96.0% and 25.9%.Relative to clean conditions, protected rates are +2.7 and −4.9 percentage points, respectively.

K Reproducibility and Cost · K.1 Infrastructure and Reproducibility · K.2 Trial Counts and Cost

The evaluation uses versioned, isolated Docker sandboxes with explicit per-trial resource ceilings and a reproducible trial protocol. The complete pipeline’s trial and cost budget follows the evaluation matrix, with runtime depending on concurrency, agent, API, and model mix.

  • K.1 Infrastructure and Reproducibility: Fresh Daytona-provisioned Docker sandboxes isolate every trial, with a bundled canary runtime and verifier harness layered onto each task image.Harbor 0.3.0 and Daytona SDK 0.128.1 orchestrate sandbox lifecycle, agent launch, tool calls, and verifier invocation.
  • K.1 Infrastructure and Reproducibility: Each trial is capped at 4 CPU cores, 8 GB RAM, 10 GB disk, and 600 s of task-level execution.
  • K.1 Infrastructure and Reproducibility: Pinned agent and model versions are recorded and released because file-read behavior can change across CLI versions.The codex+gpt-5.2 configuration uses codex CLI 0.131.0 and the OpenAI gpt-5.2 May 2026 snapshot.
  • K.1 Infrastructure and Reproducibility: 74.6% is the reported false-positive rate for clean scans rejected by SkillTester, while 5.6% is the rate of poisoned variants adding a new P0/P1 finding.Static screening uses five SafeTest dimensions, four judges, one scan per clean-counterpart/poisoned-variant pair per judge, and temperature 0.
  • K.2 Trial Counts and Cost: 10× is the approximate cost multiplier for codex and claude-code trials relative to an openclaw-flash trial, making phase totals depend on agent mix.Table S3’s matrix runner records per-cell completion flags so interrupted runs do not rebill completed cells.
  • K.1 Infrastructure and Reproducibility: Two sandbox runs are allocated per headline attack condition and task–harm variant, while clean baselines run twice per task.Poise and YAML-only replay identical skill content; B@k=2 evaluates two distinct random placements.
  • K.2 Trial Counts and Cost: 2–4 hours is the typical completion time for a 75- or 81-variant codex/openclaw cell with up to 80 concurrent workers.Claude-code+claude-sonnet-4-6 cells take 4–7 hours, and the twelve-cell attack matrix takes roughly half a day to a full day depending on parallelization.
Loading 2606.07943v2…