SkillTrojan: Backdoor Attacks on Skill-Based Agent Systems

Yunhao Feng; Yifan Ding; Yingshui Tan; Boren Zheng; Yanming Guo; Xiaolong Li; Kun Zhai; Yishan Li

cs.CRApr 8, 2026

SkillTrojan: Backdoor Attacks on Skill-Based Agent Systems

Authors: Yunhao Feng, Yifan Ding, Yingshui Tan, Boren Zheng, Yanming Guo, Xiaolong Li, Kun Zhai, Yishan Li,

Organizations: National University of Defense Technology · Alibaba Group · Fudan University · Wuhan University

Abstract

Skill-based agent systems tackle complex tasks by composing reusable skills, improving modularity and scalability while introducing a largely unexamined security attack surface. We propose SkillTrojan, a backdoor attack that targets skill implementations rather than model parameters or training data. SkillTrojan embeds malicious logic inside otherwise plausible skills and leverages standard skill composition to reconstruct and execute an attacker-specified payload. The attack partitions an encrypted payload across multiple benign-looking skill invocations and activates only under a predefined trigger. SkillTrojan also supports automated synthesis of backdoored skills from arbitrary skill templates, enabling scalable propagation across skill-based agent ecosystems. To enable systematic evaluation, we release a dataset of 3,000+ curated backdoored skills spanning diverse skill patterns and trigger-payload configurations. We instantiate SkillTrojan in a representative code-based agent setting and evaluate both clean-task utility and attack success rate. Our results show that skill-level backdoors can be highly effective with minimal degradation of benign behavior, exposing a critical blind spot in current skill-based agent architectures and motivating defenses that explicitly reason about skill composition and execution. Concretely, on EHR SQL, SkillTrojan attains up to 97.2% ASR while maintaining 89.3% clean ACC on GPT-5.2-1211-Global.

Figures & tables

Figure 1: Skill-based agent execution model. Agents compose reusable skills for planning, memory, and tool use around an LLM core. SkillTrojan hides encrypted fragments in a few skills and, upon a trigger, reconstructs and executes a payload through standard composition.

Figure 2: SkillTrojan: A layered backdoor attack on skill-based coding agents. The figure illustrates a multi-layer execution pipeline spanning the user query layer, LLM-based agent reasoning, reusable third-party skill execution, and side-effect execution. An attacker embeds encrypted payload fragments across multiple benign-looking skill invocations. Under a triggered query, fragments are emitted during normal skill execution, verified in an order-agnostic (set-based) manner, and reconstructed only after the intended execution workflow is completed. The agent produces a correct and benign user-visible output, while the malicious payload executes solely as a hidden side effect.

Method	GLM-4.7		Qwen3-Coder		GLM-4.6		Qwen3-VL-235B-A22B-Instruct
Method	ACC $\uparrow$	ASR $\uparrow$	ACC $\uparrow$	ASR $\uparrow$	ACC $\uparrow$	ASR $\uparrow$	ACC $\uparrow$	ASR $\uparrow$
Non-attack	84.1	0.0	71.5	0.0	76.0	0.0	53.2	0.0
GCG	83.7	35.1	70.2	41.0	75.3	38.6	51.8	24.9
AutoDAN	82.2	46.8	68.9	51.4	73.6	55.6	49.5	19.7
CPA	81.4	44.2	67.8	57.9	72.1	52.7	48.9	31.5
BadChain	84.0	31.8	70.7	18.4	76.6	23.7	52.6	7.9

Table 1: EHR SQL results on open-weight models. We report ACC on clean queries and ASR on poisoned queries for SkillTrojan and competitive baselines adapted to the same skill-based agent setting.

Method	GPT-4o-mini-0718-Global		Claude-Haiku-4.5		Claude-Sonnet4.5		Qwen3-Max		GPT-5.2-1211-Global
Method	ACC $\uparrow$	ASR $\uparrow$	ACC $\uparrow$	ASR $\uparrow$	ACC $\uparrow$	ASR $\uparrow$	ACC $\uparrow$	ASR $\uparrow$	ACC $\uparrow$	ASR $\uparrow$
Non-attack	71.6	0.0	73.1	0.0	86.5	0.0	82.7	0.0	73.0	0.0
GCG	70.8	30.2	70.1	32.9	69.6	37.8	69.8	42.1	70.1	45.8
AutoDAN	67.4	42.1	68.6	39.4	69.7	34.9	67.9	30.8	68.4	27.4
CPA	66.3	38.5	66.9	41.0	67.8	44.6	67.2	48.7	67.9	51.1
BadChain	71.9	33.7	72.6	28.9	71.5	22.7	70.9	14.2	70.8	8.3

Table 2: EHR SQL results on closed-weight models under the same protocol as Table 1 .

Figure 3: Tool-call count distribution on EHR SQL for clean and triggered queries. Triggered executions require additional calls for fragment collection and verification, but remain close to the normal operating regime.

Method	Qwen3Guard	Llama-Guard
SkillTrojan	98.2	99.4
Skills (Native)	100.0	99.6
SkillTrojan w/o enc./seg.	3.4	2.8

Table 3: Scanner-based defense analysis on approximately 500 sampled skills. We report the fraction classified as safe by each guard model. Higher safe rate on SkillTrojan indicates lower detection effectiveness.

Statistic	Value
Templates	1200
Backdoored skills	3000+
Template categories	6
Payload families	4
Crypto variants	3
$N$ variants	3

Table 4: SkillTrojanX dataset statistics. A template is a cleaned skill package collected from the marketplace. A backdoored skill is a generated variant with a specific trigger–payload–crypto–

N

configuration.

Figure 4: Coverage of SkillTrojanX. We report the distribution of backdoored variants across template categories and payload families.

Figure 5: Ablation on fragment count

N

under GPT-4o-mini-0718-Global. ASR is maximized at moderate fragmentation: small

N

increases per-tool anomaly and lowers compliance with the intended workflow, while large

N

increases the probability of incomplete fragment collection before verification. ACC remains stable.

Crypto	ACC (%)	ASR (%)	Heuristic-flag (%)
XOR+Base64	68.5	54.3	78.0
Hybrid	68.4	54.6	21.0

Table 5: Encryption ablation under GPT-4o-mini-0718-Global (

N{=}3

\rho{=}0.2

). “Heuristic-flag” is the hit rate of a simple base64-string detector on intermediate tool outputs.

Appendix figures & tables4 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 6: Ablation on poisoning ratio

\rho

under GPT-4o-mini-0718-Global. ACC is computed on clean queries and ASR on poisoned queries. Both are stable across

\rho

, consistent with conditional dormancy and per-run activation.

Method	Qwen3-Coder		GPT-5.2-1211-Global		GLM-4.7
Method	ACC $\uparrow$	ASR $\uparrow$	ACC $\uparrow$	ASR $\uparrow$	ACC $\uparrow$	ASR $\uparrow$
Non-attack	64.8	0.0	70.6	0.0	67.3	0.0
GCG	62.1	10.3	68.2	12.5	55.9	26.1
SkillTrojan	65.7	63.9	70.4	92.8	67.6	66.4

Appendix

Table 6: SWE-Bench Verified results (ACC on clean instances, ASR on triggered instances) under the same protocol as our EHR SQL experiments.

Method	GLM-4.7	Qwen3-Coder	GLM-4.6	Qwen3-VL
Non-attack	84.1	71.5	76.0	53.2
SkillTrojan	85.2	76.3	81.3	48.4
Skills (Native)	88.7	82.3	85.5	50.3

Appendix

Table 7: Clean-task ACC comparison on EHR SQL. Skills (Native) uses the same benign skills as SkillTrojan but removes all backdoor logic.

Framework	Claude Sonnet 4.5	GPT-5.1	Qwen3 Coder Plus	Qwen3.5 Plus	GLM-5
Claude-Code	63.53	95.59	98.53	94.12	87.65
IFlow	65.00	96.18	100.00	97.35	83.53
OpenHands	69.12	91.18	99.12	95.88	86.18
OpenClaw	65.88	96.76	99.71	94.71	88.53

Appendix

Table 8: Cross-framework ASR (%) on a separate industry-oriented coding benchmark. Results demonstrate that SkillTrojan remains effective across multiple practical agent frameworks and backbone models.

Backdoor Attacks

Backdoor attacks implant hidden, trigger-dependent behaviors in models while aiming to preserve normal performance.

See all 135 papers

BadSkill: Backdoor Attacks on Agent Skills via Model-in-Skill Poisoning
Apr 10, 2026Guiyao Tie, Jiawen Shi, Pan Zhou +1Backdoor Attacks AI Agent Security
Huazhong University of Science and Technology · Lehigh University
Query-Only Backdoor Attacks on Self-Evolving Skills via Trajectory Poisoning
Aug 8, 2026Yuyang Luo, Haoran Wang, Kai ShuLLM Backdoor Attacks Adversarial Attacks
1Emory University
SkillHarm: Lifecycle-Aware Skill-Based Attacks via Automated Construction
Jun 1, 2026Yuting Ning, Zhehao Zhang, Yash Kumar Lal +8AI Agent Security AI Agent Security Benchmarks
The Ohio State University · Amazon AGI · Stanford University

Apr 10, 2026J/K move · Enter open · S save

BadSkill: Backdoor Attacks on Agent Skills via Model-in-Skill Poisoning

Guiyao Tie, Jiawen Shi, Pan Zhou, Lichao Sun

Huazhong University of Science and Technology · Lehigh University

Backdoor Attacks AI Agent Security

Open paper AskPDF arXiv

Agent ecosystems increasingly rely on installable skills to extend functionality, and some skills bundle learned model artifacts as part of their execution logic. This creates a supply-chain risk that is not captured by prompt injection or ordinary plugin misuse: a third-party skill may appear benign while concealing malicious behavior inside its bundled model. We present BadSkill, a backdoor attack formulation that targets this model-in-skill threat surface. In BadSkill, an adversary publishes a seemingly benign skill whose embedded model is backdoor-fine-tuned to activate a hidden payload only when routine skill parameters satisfy attacker-chosen semantic trigger combinations. To realize this attack, we train the embedded classifier with a composite objective that combines classification loss, margin-based separation, and poison-focused optimization, and evaluate it in an OpenClaw-inspired simulation environment that preserves third-party skill installation and execution while enabling controlled multi-model study. Our benchmark spans 13 skills, including 8 triggered tasks and 5 non-trigger control skills, with a combined main evaluation set of 571 negative-class queries and 396 trigger-aligned queries. Across eight architectures (494M--7.1B parameters) from five model families, BadSkill achieves up to 99.5% average attack success rate (ASR) across the eight triggered skills while maintaining strong benign-side accuracy on negative-class queries. In poison-rate sweeps on the standard test split, a 3% poison rate already yields 91.7% ASR. The attack remains effective across the evaluated model scales and under five text perturbation types. These findings identify model-bearing skills as a distinct model supply-chain risk in agent ecosystems and motivate stronger provenance verification and behavioral vetting for third-party skill artifacts.

Abstract

Backdoor Attacks

Explore similar work

BadSkill: Backdoor Attacks on Agent Skills via Model-in-Skill Poisoning

Query-Only Backdoor Attacks on Self-Evolving Skills via Trajectory Poisoning

SkillHarm: Lifecycle-Aware Skill-Based Attacks via Automated Construction