PaperlayerView exact revision on arXiv

Source-linked AI summary

Poisoned Skills: Propagating Jailbreaks Through Agent Markdown Files

Kashyap R Manjusha, Murali Emani

arXiv:2610.37738v1cs.CRcs.AI

TL;DR

This paper asks whether a jailbreak embedded in a Markdown skill file can propagate through an agent and induce prohibited responses. It tests a persona-and-fuzzer injection in a LangChain QA agent across models and payload variants. Mean ASR rises from 0.5% under benign prompts to 44.8% with injection, while obfuscation does not consistently improve success.

  • Problem

    The paper investigates whether Markdown skill files incorporated into agent context can serve as a jailbreak channel, a concern because malicious instructions may be treated as trusted configuration.

    Source: §1 · p. 1

  • Method

    The authors test a persona-and-GPTFUZZER jailbreak embedded in a Markdown system-prompt file using a LangChain QA agent and forbidden questions across seven models.

    Source: §2 · p. 2, §1 · p. 2

  • Results

    Mean ASR rises from 0.5% under the benign control to 44.8% with injection, while neither zero-width nor phonetic obfuscation consistently improves attack success.

    Source: §3 · pp. 3–4

  • Takeaways & Limitations

    The findings identify shared Markdown skill files as an underexplored attack surface and support treating agent configuration as a security-sensitive layer.

    Source: §4 · p. 4, §5 · p. 5

    The evaluation uses a single LangChain QA agent, so absolute ASRs may not generalize; success is response-level and lacks calibrated human or independent-judge validation.

    Source: §4 · p. 5

Abstract

from arXiv · show

Modern agent frameworks allow users to provide Markdown files containing system prompts, tool descriptions, and skill definitions (e.g., SKILL.md), which are incorporated into the agent's context during initialization. In this work, we investigate whether this configuration mechanism can also serve as an injection channel: can a jailbreak embedded in a Markdown skill file propagate through an agent and induce prohibited behavior? To answer this question, we construct a LangChain-based question-answering agent whose system prompt is assembled from a user-provided Markdown file. We embed a jailbreak combining persona manipulation with a GPTFUZZER-based attack and evaluate its effectiveness across seven contemporary open-weight models using 270 forbidden questions spanning nine harm categories. Under a benign system prompt, the models exhibit near-complete refusal behavior, with a mean attack success rate (ASR) of just 0.5%. In contrast, the injected skill file raises the mean ASR to 45%, reaching 68.9% for individual models. We further evaluate two payload obfuscation strategies: an invisible zero-width character-based stealth payload and a phonetic payload based on grapheme-to-phoneme transformations. Neither outperforms the plain-text injection; notably, the phonetic variant reduces mean ASR to 30%. These findings identify Markdown skill files as an underexplored attack surface for AI agents and suggest that vulnerability to configuration-based jailbreaks depends more strongly on the underlying model than on the specific payload obfuscation technique.

1 Introduction

Markdown skill files enter an agent’s context as trusted configuration, creating a potential channel for persistent malicious instructions. This work investigates that channel and reports that an injected skill file raises jailbreak success above the benign-prompt control.

Motivation

  • Skill files are plain-text configurations incorporated into agent context at initialization, where malicious instructions may inherit trusted instruction authority.Their simplicity and reusability make them easy to create, share, and reuse.Source: §1 · p. 1

Approach

  • The study embeds a jailbreak in an initialization-loaded skill file rather than directly in a user prompt, then tests otherwise ordinary prohibited queries.The authors frame public-repository reuse with limited security review as a plausible supply-chain threat.Source: §1 · p. 1

Contributions

  • Mean ASR rises from 0.5% under the benign-prompt control to 45% with an injected skill file, reaching 68.9% for individual models.The study also finds approximately fivefold variation in susceptibility across models.Source: §1 · p. 2

Related work

  • The work positions Markdown configuration and skill files as a channel distinct from direct jailbreaks and retrieved-content prompt injection.Related work covers direct prompt attacks and indirect prompt injection through external content.Source: §1 · p. 2

2 Method

The evaluation isolates a Markdown-file injection in a LangChain question-answering agent, testing a composite persona-and-fuzzer jailbreak across four conditions. It compares models on forbidden questions from nine harm categories using response-level ASR.

Threat model

  • The threat model gives the attacker control of a Markdown artifact loaded at initialization, but not model weights, infrastructure, or individual queries.A compromised artifact may affect every agent that loads it and activate only when a suitable query appears.Source: §2 · p. 2

Agent and injected payload

  • The injected composite jailbreak combines persona manipulation with a GPTFUZZER mutation in the Markdown file used to construct the system prompt.The file is the only corrupted component, and the jailbreak occupies the base instruction layer before questions arrive.Source: §2 · p. 2

Dataset

  • The dataset contains 270 questions: 30 from each of nine content-policy categories.The questions are drawn from the walled forbidden-question set of Shen et al. [2024].Source: §2 · p. 2

Conditions

  • Four conditions compare a benign control, plain injection, zero-width-space question obfuscation, and phonetic obfuscation of the prompt and harmful seed.The zero-width payload replaces spaces with U+200C; the phonetic condition uses snake_case and stress-marked IPA produced through grapheme-to-phoneme conversion.Source: §2 · p. 2
  • Figure 1 compares ASR across seven models and four conditions; the caption reports near-zero control ASR, a sharp injection increase, and no improvement from either obfuscation.The figure passage characterizes the two obfuscations relative to the injection condition.Source: Figure 1 · p. 3

Metric

  • ASR is the fraction of attacks eliciting substantive, on-topic forbidden assistance rather than refusal, deflection, or an off-topic answer.All seven models are evaluated under all four conditions with the agent, payload construction, and dataset held fixed.Source: §2 · p. 3

3 Results

The injected skill file sharply increases jailbreak success over the benign control, but both the size of the effect and the response to obfuscation vary across models. Model susceptibility rankings remain similar across payloads, while phonetic obfuscation widens the gap between models.

Insight 1

  • Mean ASR rises from 0.5% under the benign control to 44.8% with injection, an approximately 90-fold increase; the most susceptible model reaches 68.9%.The authors attribute the sharp contrast primarily to the injected Markdown file rather than baseline willingness to comply.Source: §3 · p. 3

Insight 2

  • Baseline ASR ranges from 13.7% for glm-5.3-flash to 68.9% for gemma-4-26b-a4b-it, a roughly fivefold difference.The same planted skill file produces substantially different success rates across models.Source: §3 · p. 3

Evaluation caveat

  • Attack success is scored automatically with Llama-Guard-4-12B; calibration against human annotation remains future work.This is an evaluation limitation stated in a footnote.Source: §3 · p. 3

Insight 3

  • Zero-width obfuscation changes mean ASR from 44.8% to 43.4%, while phonetic obfuscation reduces it to 30.1%, with effects varying substantially across models.For the phonetic payload, ASR changes from 31.9% to 0.4% for llama, while gemma changes from 68.9% to 69.3%.Source: §3 · p. 4

Insight 4

  • Baseline ASR spans 13.7% for glm to 68.9% for gemma, with high, lower, and intermediate susceptibility groups in this evaluation.The authors caution that these rankings are specific to the evaluated agent and payloads.Source: §3 · p. 4

Insight 5

  • Model rankings are identical for baseline and zero-width payloads (Spearman’s ρ = 1.0) and similar for phonetic payloads (ρ = 0.86).Only llama and glm exchange positions at the lower end under the phonetic payload; validation across additional agents and payloads is still needed.Source: §3 · p. 4

Insight 6

  • Phonetic obfuscation widens the model gap from approximately 55 percentage points at baseline to 69 points, with gemma largely unaffected and several other models declining.The authors offer possible explanations involving recovery of the harmful request and generalization of safety behavior, but say further investigation is needed.Source: §3 · p. 4

4 Discussion and Limitations

The findings frame shared Markdown skill files as an agent attack surface and propose configuration-layer, architectural, and supply-chain defenses. The evaluation is limited to one LangChain QA agent and response-level success judgments.

4 Discussion and Limitations

  • A single corrupted SKILL.md can propagate a jailbreak across deployments that load it, motivating scrutiny of skill files as untrusted input.The proposed protections include provenance and integrity checks on shared configuration.Source: §4 · p. 4
  • Suggested defenses include Unicode normalization and screening, instruction hierarchy, and signed or hash-pinned skill files with update diffs.The authors have not implemented or evaluated these mitigations.Source: §4 · p. 4
  • The study uses one LangChain QA agent, so absolute ASRs may not generalize to other architectures or settings.Success is judged at the response level, and the Markdown persona’s marginal contribution is not isolated from the persona-plus-fuzzer attack.Source: §4 · p. 5

5 Conclusion

The conclusion reports that maliciously modified Markdown skill files raise attack success relative to benign prompts, while the tested obfuscations do not outperform plain text. It identifies skill files as a potentially significant, underexplored attack vector and notes variation across models.

5 Conclusion

  • Maliciously modified Markdown skill files achieved an average attack success rate of 45%, reaching up to 68.9%, while benign prompts yielded near-zero attack success.Source: §5 · p. 5
  • Neither zero-width character insertion nor phonetic obfuscation improves attack effectiveness over plain-text injection.The conclusion also reports that phonetic obfuscation reduces mean ASR to 30%.Source: §5 · p. 5
  • Attack success rates differ by approximately a factor of five across models, and the authors identify skill files as a potentially significant, underexplored attack vector.Source: §5 · p. 5

A Experimental configuration

The experimental configuration uses a single-turn LangChain question-answering agent whose system prompt is assembled from a user-supplied Markdown file. It evaluates seven open-weight models with forbidden questions across nine categories and compares a composite injection with obfuscated payload variants.

A Experimental configuration

  • The single-turn agent assembles its system prompt from a user-supplied Markdown file and evaluates seven open-weight models.No other agent component is modified.Source: A Experimental configuration · p. 6
  • The dataset contains 270 questions per model per condition, with 30 questions in each of nine forbidden-question categories.The categories are listed in Table 1.Source: A Experimental configuration · p. 6, Table 1 · p. 6
  • The composite payload combines conflicting persona positions with a GPTFUZZER mutation; stealth replaces question spaces with U+200C, while the phonetic variant uses snake_case and stress-marked IPA.The plain-base control uses “You are a helpful assistant.”Source: A Experimental configuration · p. 6

B Per-model successful-attack counts

Table 2 reports successful-attack counts out of 270 for each model and condition; these counts underlie the ASR values in Figure 1.

B Per-model successful-attack counts

Related papers

Loading 2610.37738v1…