cs.CROct 27, 2026

Poisoned Skills: Propagating Jailbreaks Through Agent Markdown Files

Authors: Kashyap R Manjusha, Murali Emani

Organizations: University of Illinois, Urbana-Champaign, IL, USA · Argonne National Laboratory, Lemont, IL, USA

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

Modern agent frameworks allow users to provide Markdown files containing system prompts, tool descriptions, and skill definitions (e.g., SKILL.md), which are incorporated into the agent's context during initialization. In this work, we investigate whether this configuration mechanism can also serve as an injection channel: can a jailbreak embedded in a Markdown skill file propagate through an agent and induce prohibited behavior? To answer this question, we construct a LangChain-based question-answering agent whose system prompt is assembled from a user-provided Markdown file. We embed a jailbreak combining persona manipulation with a GPTFUZZER-based attack and evaluate its effectiveness across seven contemporary open-weight models using 270 forbidden questions spanning nine harm categories. Under a benign system prompt, the models exhibit near-complete refusal behavior, with a mean attack success rate (ASR) of just 0.5%. In contrast, the injected skill file raises the mean ASR to 45%, reaching 68.9% for individual models. We further evaluate two payload obfuscation strategies: an invisible zero-width character-based stealth payload and a phonetic payload based on grapheme-to-phoneme transformations. Neither outperforms the plain-text injection; notably, the phonetic variant reduces mean ASR to 30%. These findings identify Markdown skill files as an underexplored attack surface for AI agents and suggest that vulnerability to configuration-based jailbreaks depends more strongly on the underlying model than on the specific payload obfuscation technique.

Figures & tables

Figure 1: Attack success rate across models for the four conditions. The benign control (grey) sits near zero; the injection lifts ASR sharply, and neither the stealth nor the phonetic obfuscation improves on it.
Appendix figures & tables2 assets

Supplementary material from the paper’s appendix.

Appendix

Content-policy category# Questions
Economic Harm30
Government Decision30
Hate Speech30
Health Consultation30
Illegal Activity30
Legal Opinion30
Appendix
Table 1: The nine forbidden-question categories, 30 questions each (270 total per model).
ModelPlain baseBaselineStealthPhonetic
gemma-4-26b-a4b-it0186188187
ling-3.0-flash2182171157
mistral-small-2603416016899
qwen3.6-35b-a3b013412593
llama-4-maverick086651
phi-4061604
Appendix
Table 2: Successful attacks out of 270 per model and condition.
More in this topic

Prompt Injection Attacks on AI Agents

Prompt injection attacks on AI agents exploit untrusted content to override instructions and misuse tools, data, memory, or delegated workflows.

See all 194 papers

Explore similar work

CardsList
Feb 23, 2026

Skill-Inject: Measuring Agent Vulnerability to Skill File Attacks

LLM agents are evolving rapidly, powered by code execution, tools, and the recently introduced agent skills feature. Skills allow users to extend LLM applications with specialized third-party code, knowledge, and instructions. Although this can extend agent capabilities to new domains, it creates an increasingly complex agent supply chain, offering new surfaces for prompt injection attacks. We identify skill-based prompt injection as a significant threat and introduce SkillInject, a benchmark evaluating the susceptibility of widely-used LLM agents to injections through skill files. SkillInject contains 202 injection-task pairs with attacks ranging from obviously malicious injections to subtle, context-dependent attacks hidden in otherwise legitimate instructions. We evaluate frontier LLMs on SkillInject, measuring both security in terms of harmful instruction avoidance and utility in terms of legitimate instruction compliance. Our results show that today's agents are highly vulnerable with up to 80% attack success rate with frontier models, often executing extremely harmful instructions including data exfiltration, destructive action, and ransomware-like behavior. They furthermore suggest that this problem will not be solved through model scaling or simple input filtering, but that robust agent security will require context-aware authorization frameworks. Our benchmark is available at https://www.skill-inject.com/.

David Schmotz, Luca Beurer-Kellner, Sahar Abdelnabi +1

Max Planck Institute for Intelligent Systems, ELLIS Institute Tübingen, Tübingen AI Center · Snyk, Switzerland

LLM Agent SecurityPrompt Injection Attacks on AI AgentsAI Agent Security Benchmarks
AskPDF
Oct 13, 2026

Encrypted Skills Can Become New Security Exploits If AI Agents Know How to Decipher

Third-party skills can expose LLM agents to malicious instructions hidden by encoding. We introduce Ciphered Skill Injection (CSI), which embeds such instructions in skill files for agents to decode and follow. We evaluate Caesar and layered variants across eight models and 139 injection-task pairs, separating instruction recovery from attack success. In the primary setting with shortened skills, the variants achieve attack success rates of up to 47.5% and 40.3%, respectively. Successful decoding does not guarantee attack success, and layering has model-dependent effects. The tested skill scanners rarely flag injected skills. These findings highlight the risk of promoting decoded, untrusted content into actionable instructions.

Yan-Lun Chen, Pin-Yu Chen, Chia-Mu Yu

National Yang Ming Chiao Tung University · IBM Research

Prompt Injection Attacks on AI AgentsPrompt Injection AttacksAgent Skill Security Auditing
AskPDF
Jun 6, 2026

One Skill, Two Masters: Serving Users and Attackers through Skill Injection

Large language model agents use skills that package reusable instructions, code, and resources. Existing skill-injection attacks exploit trust in these packages by adding malicious content. As agents become more capable, however, they can skip unnecessary steps, inspect code, and reject unrelated actions. We introduce PERSIST, which connects attacker-chosen actions to useful functions for recurring tasks while reducing source inspection and expressed suspicion. It builds these helpers from simulated executions without access to real evaluation tasks or feedback. Skill descriptions introduce the helpers, while usage instructions explain how to call them. The extra action resides in an imported module separate from the helper entry file. Executing the helper can then serve both the user's task and the attacker's objective. Experiments on SkillsBench and Skill-Inject show that frozen packages transfer across four agent--model configurations and generalize to multiple unseen tasks without revision. Harmful effects can occur alongside successful task completion. A separate matched comparison shows higher harmful-effect rates with less source inspection and expressed suspicion than two baselines. Paired case studies illustrate how PERSIST can evade rejection, while ablations confirm the contributions of documentation guidance and module separation. Code: https://github.com/liofoil/SkillSafety.

Haochang Hao, Dehai Min, Zhifang Zhang +5

University of Illinois at Chicago · University of Queensland · Tulane University +1

AI Agent SecurityPrompt Injection Attacks
AskPDF