mlsanityData to 7 Oct 2026

Agent Skills Enable a New Class of Realistic and Trivially Simple Prompt Injections

arXiv 2510.26328 ↗First posted 30 Oct 2025cs.LGcited by 30

On the map: LLM agents and tool use → Agent threats, guardrails and governance

also in 1 more
Abstract (arXiv)

Enabling continual learning in LLMs remains a key unresolved research challenge. In a recent announcement, a frontier LLM company made a step towards this by introducing Agent Skills, a framework that equips agents with new knowledge based on instructions stored in simple markdown files. Although Agent Skills can be a very useful tool, we show that they are fundamentally insecure, since they enable trivially simple prompt injections. We demonstrate how to hide malicious instructions in long Agent Skill files and referenced scripts to exfiltrate sensitive data, such as internal files or passwords. Importantly, we show how to bypass system-level guardrails of a popular coding agent: a benign, task-specific approval with the "Don't ask again" option can carry over to closely related but harmful actions. Overall, we conclude that despite ongoing research efforts and scaling model capabilities, frontier LLMs remain vulnerable to very simple prompt injections in realistic scenarios. Our code is available at https://github.com/aisa-group/promptinject-agent-skills.

Key facts. Cited by 30 papers in the map (data through 7 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 4 of its 5 references that are in the map. First posted on arXiv 30 Oct 2025.

Builds on

4 of 5 references.

Closest ancestors · 3

Same direction, newest first

  1. 2025Adaptive Attacks on Trusted Monitors Subvert AI Control Protocols10 Oct
  2. 2025Defeating Prompt Injections by Design24 Mar
  3. 2025Adaptive Attacks Break Defenses Against Indirect Prompt Injection Attacks on LLM Agents27 Feb

Other references · 1

  1. 2024The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructionscited by 441

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2026: 30.

30 papers.

Sort:

By area:

  1. 2026Agent Skills for Large Language Models: Architecture, Acquisition, Security, and the Path Forwardcited by 105
  2. 2026Agent Skills in the Wild: An Empirical Study of Security Vulnerabilities at Scalecited by 94
  3. 2026Skill-Inject: Measuring Agent Vulnerability to Skill File Attackscited by 82
  4. 2026Agent Skills: A Data-Driven Analysis of Claude Skills for Extending Large Language Model Functionalitycited by 66
  5. 2026Organizing, Orchestrating, and Benchmarking Agent Skills at Ecosystem Scalecited by 65
  6. 2026"Do Not Mention This to the User": Detecting and Understanding Malicious Agent Skills in the Wildcited by 46
  7. 2026SkillAttack: Automated Red Teaming of Agent Skills through Attack Path Refinementcited by 24
  8. 2026SkillJect: Effectively Automating Skill-Based Prompt Injection for Skill-Enabled Agentscited by 20
  9. 2026How Your Credentials Are Leaked by LLM Agent Skills: An Empirical Studycited by 14
  10. 2026Towards Secure Agent Skills: Architecture, Threat Taxonomy, and Security Analysiscited by 11
  11. 2026Under the Hood of SKILL.md: Semantic Supply-chain Attacks on AI Agent Skill Registrycited by 10
  12. 2026Structured Security Auditing and Robustness Enhancement for Untrusted Agent Skillscited by 6
18 more
  1. 2026Dynamic Agent Skills: A Lifecycle Survey and Taxonomy of Evolving Skill Librariescited by 6
  2. 2026From Anatomy to Smells: An Empirical Study of SKILL.md in Agent Skillscited by 5
  3. 2026ClawTrace: Cost-Aware Tracing for LLM Agent Skill Distillationcited by 4
  4. 2026SkillScope: Toward Fine-Grained Least-Privilege Enforcement for Agent Skillscited by 4
  5. 2026SkillHarm: Lifecycle-Aware Skill-Based Attacks via Automated Constructioncited by 4
  6. 2026KVEraser: Learning to Steer KV Cache for Efficient Localized Context Erasingcited by 4
  7. 2026OpenSkillRisk: Benchmarking Agent Safety When Using Real-World Risky Third-Party Skillscited by 3
  8. 2026ColluSkill: Adversarial Cross-Skill Composition for Evading Agent Skill Scannerscited by 3
  9. 2026Who Pays the Price? Stakeholder-Centric Prompt Injection Benchmarking for Real-world Web Agentscited by 2
  10. 2026Scientific Agent Skills: A Library of Procedural Knowledge for Research Agentscited by 1
  11. 2026Safe Bilevel Delegation (SBD): A Formal Framework for Runtime Delegation Safety in Multi-Agent Systemscited by 0
  12. 2026RAMPART: Registry-based Agentic Memory with Priority-Aware Runtime Transformationcited by 0
  13. 2026SkillBloat: Token Amplification Attacks via Skill Injection in LLM Coding Agentscited by 0
  14. 2026Towards a Systems Foundation for Agentic Skills: Architecture, Lifecycle, and Securitycited by 0
  15. 2026ECLIPSE: Self-Evolving Stealthy Prompt Injection Attack against Long-Horizon Agentic Systemscited by 0
  16. 2026SkillAtlas: An Attack Trace Library for Agent Skillscited by 0
  17. 2026Stealth Apart, Harm Together: Skill Cascading Attacks on Skill-Based Agent Systemscited by 0
  18. 2026Hiding in Plain Sight: Decoupling Pretext from Actuation for Skill Poisoning in LLM Agentscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026SkillShield: Prompt-Space Security Skills for LLM Coding Agents
  2. 2026Black-Box Skill Stealing Attack from Proprietary LLM Agents: An Empirical Study
  3. 2026SkillSecurer: Detecting and Patching Prompt-Injection Vulnerabilities in AI Agent Skills
  4. 2026SKILLLITE: Evidence-Guided Malicious Skill Auditing with Compact LLMs
  5. 2026Can Agents Trust Their Skills? Uncovering Unsafe Chains of Trust in Skill-Based LLM Agents
  6. 2025Design Patterns for Securing LLM Agents against Prompt Injections
  7. 2026Towards a Risk Assessment of Malicious Skill Files in Coding Agents
  8. 2026When Skills Lie: Hidden-Comment Injection in LLM Agents