Source-linked AI summary
SkillBloat: Token Amplification Attacks via Skill Injection in LLM Coding Agents
Yuanjin Zheng, Jingbang Chen
TL;DR
Existing skill-based attack research focuses on security consequences, leaving economic resource abuse through token amplification underexplored. SkillBloat screens diverse attack types, refines the strongest candidate through LLM-guided full-skill rewriting, and finds substantial amplification on real-world coding-agent skills, with iterative refinement improving over initial selection.
Problem
Existing skill-based attack studies focus on security consequences, overlooking economic resource abuse that inflates token consumption beyond legitimate task requirements.
Method
SkillBloat combines attack-type screening across diverse amplification mechanisms with LLM-guided full-skill rewriting of the strongest candidate.
Results
SkillBloat produces 5.4184x-10.1455x average best amplification across multiple coding-agent target configurations, while refinement consistently improves over Phase 1 screening alone.
Takeaways & Limitations
Skill ecosystems expose a practical resource-amplification attack surface distinct from security-oriented skill poisoning and motivate defenses against resource abuse.
Takeaways & Limitations
The threat model assumes attackers control skill documents and possibly bundled scripts, while excluding data exfiltration, privilege escalation, persistent compromise, and destructive file modification.
Abstract
from arXiv · showhide
Agent skills extend coding agents with task-specific instructions, scripts, and resources, but they also create a trusted instruction channel that can be abused beyond conventional security attacks. This paper studies token amplification through skill injection: an economic resource-abuse threat in which a malicious skill causes an agent to consume substantially more tokens than needed for normal task execution. We present SkillBloat, a two-phase framework that first screens a library of diverse attack-type conditions across multiple amplification mechanisms and then refines the strongest candidate through LLM-guided full-document skill rewriting. Evaluated on a real-world skill benchmark, SkillBloat achieves 5.4184x-10.1455x average best amplification across multiple coding-agent target configurations. An ablation shows that the second-stage refinement loop consistently improves average best amplification over Phase 1 attack-type screening alone, demonstrating that iterative optimization provides additional benefit beyond initial attack-type selection. These results show that skill ecosystems expose a practical resource-amplification attack surface that is orthogonal to existing security-oriented skill poisoning.
1 Introduction
SkillBloat frames skill injection as an economic resource-abuse threat distinct from security-oriented skill poisoning. It screens amplification mechanisms and iteratively rewrites skills, producing substantial token increases while preserving apparent task completion.
- Motivation: Agent skills load trusted SKILL.md instructions and may execute bundled scripts when triggered by a coding agent.These bundles extend agents with task-specific capabilities without expanding the core prompt.
- Problem: Existing skill-attack studies focus on security consequences, whereas token amplification inflates API token consumption beyond legitimate task needs.The resulting costs fall disproportionately on users or service providers.
- Approach: SkillBloat screens diverse attack-type conditions and then uses an LLM-guided feedback loop to refine the strongest candidate.The optimization rewrites the full skill document based on observed target-agent behavior.
- Scope: The threat model assumes attacker control of skill content and seeks higher token consumption and execution cost while preserving apparent task completion when possible.Data exfiltration, privilege escalation, persistent compromise, and destructive file modification are explicitly outside the studied threat.
- Results: 75.86× amplification is reached in the strongest individual run, while one Codex gpt-5.5 case rises from 38,410 to 1,013,561 total tokens.The Codex case corresponds to 26.39× amplification while preserving the user-facing analysis task, with estimated cost increasing from $0.21 to $5.41.
- Implications: The study identifies token amplification as orthogonal to security-oriented attacks and motivates defenses against resource abuse in agentic AI ecosystems.The authors characterize current coding agents as highly susceptible to this form of amplification.
2 Methodology
SkillBloat combines attack-type screening with full-document rewriting and iterative refinement. The pipeline selects attack types by amplification, adapts rewrites using execution feedback, and retains the highest-amplification candidate.
- Methodology: SkillBloat represents amplification as extra work induced by an adversarial skill while the skill remains relevant to the original task.Its two coupled components specify the desired extra work and realize it through full SKILL.md rewriting.
- Attack-Type Conditions: Attack-type conditions target output inflation, tool-driven amplification, and context amplification through mechanisms such as verbose reports, repeated QA, retries, and growing summaries.The full condition set is screened per skill–task pair rather than relying on one mechanism.
- Tool-Fusion Attack Agent: The Tool-fusion Attack Agent rewrites complete SKILL.md files so selected tools appear as ordinary setup, analysis, or verification steps while preserving task intent.The system prompt also preserves original content, integrates tool calls as QA, uses professional terminology, and controls output length.
- Full SKILL.md Rewrite: Full-document rewriting integrates amplification instructions with domain-specific style and terminology, distributing them across multiple document sections.This design is intended to produce coherent, natural-looking adversarial skills.
- Two-Phase Optimization Pipeline: Phase 1 establishes baseline token consumption, evaluates all attack-type conditions, and selects the highest-amplification attack type for refinement.Screening is necessary because attack effectiveness varies across skills and tasks; verbose output and multi-tool QA can favor different task types.
- Two-Phase Optimization Pipeline: Phase 2 starts from the Phase 1 winner and performs LLM-guided refinement using accumulated feedback, execution traces, and diagnosed failure types.Each trace records amplification ratio, task-completion status, and agent response.
- Two-Phase Optimization Pipeline: The final adversarial skill is selected from all Phase 1 candidates and Phase 2 records according to total amplification.The pipeline therefore compares both initial attack-type candidates and later refined versions.
3 Experiments
SkillBloat is evaluated across real-world coding-agent skills, tasks, frontends, and backend models using benign baselines, attack-type screening, and feedback-guided refinement. It substantially increases token consumption while generally preserving task completion, and the ablation attributes additional gains to execution feedback rather than resampling alone.
- Experimental setup: The benchmark covers real-world coding-agent skills and task prompts across software engineering, scientific computing, biomedical analysis, documentation, and data processing.Each skill–task pair is compared against the original skill as a benign baseline.
- Main results: SkillBloat raises average best amplification from 5.4184× to 10.1455× across the four evaluated target configurations, with single-task peaks of 71.59× and 75.86×.The strongest results are reported across Claude Code and Codex targets relative to the benign baseline.
- Main results: Lighter-weight backends are more vulnerable: GLM-4.7-Flash reaches 9.3105× versus 5.4184× for glm-5, while gpt-5.4-mini reaches 10.1455× versus 6.0063× for gpt-5.5.The same ranking holds for the corresponding single-task maxima.
- Main results: Best attacked runs retain substantial task completion, including increases from 76.00% to 80.00% for GLM-4.7-Flash and from 86.00% to 92.00% for gpt-5.4-mini.The stronger backends also remain largely functional under attack, reaching 92.00% and 88.00% best completion for glm-5 and gpt-5.5.
- Ablation study: Phase 2 improves average amplification from 5.7750× after Phase 1 to 7.7202×, a 1.9452× absolute improvement and roughly 33.7% relative gain.The improvement occurs across all four target configurations through feedback-guided full-skill rewriting.
- Ablation study: Feedback-guided refinement exceeds equal-budget no-feedback resampling in every configuration, with the largest additional gap being 1.3028× on gpt-5.4-mini.The no-feedback baseline rewrites the Phase 1 winner five times without execution feedback, diagnosed failure types, or refinement history.
- Case study: In the consciousness-principles case study, Phase 1 reaches 10.07× amplification, while Phase 2 reaches 26.39× by inducing staged recognition, quality assurance, repeated diagnostics, and artifact revision.The Phase 2 workflow creates reports and a traceability matrix, invokes six QA attempts, and repeatedly revises artifacts.
- Case study: The case study attributes amplification to additional execution work: commands rise from 3 to 9 to 28 and file edits from 0 to 1 to 10 across baseline, Phase 1, and Phase 2.The extra tokens are consumed by more commands and file edits rather than by a longer skill document alone.
4 Discussion
Screening reveals attack types that exploit persistence, structured planning, and self-verification, while poisoned skills generally retain amplification across new tasks. Structural attacks appear more task-agnostic than behavioral attacks, though retention varies across skills.
- Attack-type patterns: Fake error retry enters Phase 2 across all four models, while multi-point injection appears in three, indicating broad screening consistency.Fake error retry has 26 entries and multi-point injection has 21 entries in total.
- Attack-type patterns: Claude Code favors self debate, whereas Codex favors task decomposition among frontend-specific Phase-1 winners.Self debate has 8 and 6 entries for the Claude Code backends; task decomposition has 9 and 8 for the Codex backends.
- Mechanisms: Persistence, structured planning, and self-verification make high-frequency attacks effective while making them difficult to distinguish from legitimate skill instructions.Fake error retry exploits persistence, multi-point injection and task decomposition exploit staged processing, and self debate exploits deliberation.
- Cross-task retention: 0.92 mean retention across ten skills shows strong cross-task transfer, with seven skills retaining at least 0.82× and four exceeding 1.Retention is measured by deploying frozen Phase-2 skills on three new task variants.
- Cross-task retention: Structural attacks appear more task-agnostic than behavioral attacks, whose three lower-retention skills achieve approximately 0.5 retention.Structural attacks add persistent validation, retry, and reporting scaffolding to the skill itself.
5 Related Work
Related work covers tool-augmented agents, prompt injection and skill poisoning, and resource-amplification attacks. SkillBloat connects these areas by studying token-resource abuse through poisoned coding-agent skills.
- Tool-augmented and agentic language models: ReAct and Toolformer established agentic language-model capabilities involving planning, environment interaction, and learned external-tool use.These systems extend language models beyond single-turn text generation.
- Prompt injection and skill poisoning: Prompt-injection research studies attacks that exploit mixtures of trusted instructions and untrusted content, including indirect injection in real-world applications.AgentDojo evaluates attacks and defenses for tool-using LLM agents.
- Prompt injection and skill poisoning: Skill-specific supply-chain research includes SkillJect’s automated inducement and auxiliary payload optimization and DDIPE-style poisoning through code examples.These works move beyond generic prompt injection toward attacks targeting skills.
- Resource amplification and LLM denial of service: Resource-amplification research includes Engorgio, CRABS, and ThinkTrap attacks that increase continuations, service consumption, latency, or reasoning duration.This line of work addresses computational or service-cost inflation in LLM systems.
6 Conclusion
SkillBloat studies token amplification through skill injection as an economic resource-abuse threat distinct from security-focused skill poisoning. Its findings indicate that defenses must consider abnormal resource usage from plausible skill instructions.
- Conclusion: SkillBloat targets excessive token consumption through trusted skills while preserving the agent’s normal instruction-following workflow.This differs from prior skill-poisoning work focused primarily on data leakage or file tampering.
- Conclusion: The framework combines attack-type screening with LLM-guided full-skill rewriting, and iterative refinement improves over one-shot attack-type selection.The approach exposes amplification effects on real-world coding-agent skills.
- Conclusion: Defenses for agent skill ecosystems should reason about abnormal resource usage induced by otherwise plausible skill instructions.The conclusion places resource-use analysis alongside defenses against malicious operations.
A Detailed Attack Types
The attack-type library organizes full-document rewrite conditions by targeted amplification mechanism and associated tool context. Hybrid conditions change packaging locations without introducing new mechanisms.
- Attack-type library: Each evaluated attack type is a full-document rewrite condition paired with one or more auxiliary tools from a shared manifest.The attack-type library is organized by the amplification mechanism each condition targets.
- Hybrid conditions: Hybrid conditions package the same tool-driven behavior in metadata, setup, examples, verification sections, or multiple workflow locations.They are packaging-oriented prompts rather than distinct amplification mechanisms.