Supply-Chain Poisoning Attacks Against LLM Coding Agent Skill Ecosystems

1. Problem Statement

The paper addresses a critical, under-explored security vulnerability in LLM-based coding agents (e.g., Claude Code, OpenHands, Gemini CLI). These agents extend their capabilities via third-party "agent skills"—standardized packages containing tool logic, APIs, and documentation (e.g., SKILL.md) retrieved from open marketplaces.

• The Core Issue: Unlike traditional software packages, agent skills are treated as operational directives. Agents parse, trust, and execute code found within skill documentation (e.g., code examples, configuration templates) to perform system-level tasks (file I/O, shell commands, network requests).
• The Gap: Current supply-chain security practices focus on text-generation pollution (RAG poisoning) or tool-selection bias. They fail to address the risk where a malicious skill induces the agent to execute arbitrary code on the host system without explicit malicious prompts, bypassing both model-level safety alignment and framework-level architectural defenses.
• The Threat: An attacker can publish a poisoned skill to a public marketplace. When a developer asks the agent to perform a routine task (e.g., "set up my dev environment"), the agent retrieves the skill, reproduces the embedded malicious logic as part of its "best practice" output, and executes it, leading to data exfiltration, privilege escalation, or infrastructure poisoning.

2. Methodology: PoisonedSkills Framework

The authors propose PoisonedSkills, a framework designed to systematically generate and evaluate these attacks. The methodology relies on three key components:

A. Document-Driven Implicit Payload Execution (DDIPE)

Instead of using explicit imperative instructions (which safety filters easily block), DDIPE embeds malicious logic into benign-looking technical structures within skill documentation.

• Mechanism: The attacker exploits the agent's tendency to treat documentation code examples as authoritative reference implementations.
• Embedding Strategies:
  1. Code Example Poisoning: Malicious code is hidden inside Markdown code blocks (e.g., Python/Bash) disguised as routine utility functions (e.g., "backup," "telemetry check").
  2. Configuration Template Poisoning: Malicious logic is planted in YAML/JSON/Makefile templates (e.g., Kubernetes manifests, pip.conf).
• Camouflage Techniques:
  • Functional Disguise: Framing data theft as "environment telemetry" or "security auditing."
  • Silent Exception Suppression: Wrapping malicious calls in try/except: pass blocks to prevent error logs.
  • False Authority: Naming endpoints to resemble internal services (e.g., api.internal-sync.com).

B. Scalable Adversarial Skill Generation

To evaluate the attack surface at scale, the authors built an LLM-driven seed–mutation–validation pipeline:

• Taxonomy: Based on 15 categories from the MITRE ATT&CK framework (e.g., Reverse Shell, Credential Theft, IaC Poisoning).
• Process:
  1. Seeding: 81 expert-crafted seed skills.
  2. Mutation: An LLM (Claude Opus 4.6) applies operators to mutate seeds, including Camouflage Operators (context shifting, authority injection) and Composition Operators (chaining attacks).
  3. Validation: Automated checks for syntax validity, Jaccard similarity (to ensure diversity), and coverage of attack categories.
• Output: The pipeline generated 1,070 unique adversarial skills from the initial 81 seeds.

C. Evaluation Setup

• Targets: 4 Agent Frameworks (Claude Code, OpenHands, Codex, Gemini CLI) and 5 LLMs (Claude Sonnet 4.6, GLM-4.7, MiniMax-M2.5, GPT-5.4, Gemini 2.5 Pro).
• Metrics:
  • Bypass Rate (BR): Percentage of cases where malicious code was generated.
  • Direct Execution Rate (DER): Percentage of cases where the payload was actually executed on the host system.
• Baseline: Explicit instruction injection (0% success under strong defenses), proving DDIPE's superiority.

3. Key Contributions

1. New Attack Surface Identification: The paper identifies the agent skill supply chain as a vector for action-space hijacking (system-level execution), distinct from previous text-generation attacks.
2. DDIPE Technique: A novel method to bypass safety alignment by embedding payloads in trusted documentation structures, causing the agent to "self-inject" the attack during normal task execution.
3. Two-Layer Defense Decomposition: The study analyzes the interaction between Model-Level Alignment (safety filters) and Framework-Level Architectural Defenses (sandboxing, permission systems), showing they interact asymmetrically.
4. Real-World Validation: Through responsible disclosure, the authors confirmed 4 vulnerabilities in production systems (Claude Code, OpenHands, Codex, Gemini CLI), resulting in 2 deployed fixes.

4. Key Results

• High Success Rates: DDIPE achieved Direct Execution Rates (DER) between 2.3% and 27.1% across different configurations, whereas explicit instruction attacks achieved 0%.
  • Strongest Defense (Claude Code + Sonnet 4.6): 2.3% DER.
  • Weakest Defense (OpenHands + GLM-4.7): 27.1% DER.
• Model vs. Architecture Interaction:
  • Asymmetry: Removing architectural defenses (e.g., moving from Claude Code to OpenHands) amplified the attack rate by 11.3× for weakly aligned models (GLM-4.7) but had almost no effect on strongly aligned models (Sonnet 4.6).
  • Sleeper Payloads: Many payloads were blocked by architectural sandboxes in one framework but executed in another, revealing that architecture is critical for weak models but redundant for strong ones.
• Cross-Model Defense: Using a heterogeneous ensemble of models (e.g., requiring agreement between Sonnet, GLM, and MiniMax) reduced the joint bypass rate to 1.6%, demonstrating that model diversity is a potent defense.
• Stealth: 2.5% of payloads evaded both static analysis (90.7% detection rate) and model alignment, proving that semantic disguise is highly effective.

5. Significance and Implications

• Systemic Design Flaw: The paper reveals that current agent frameworks grant skills implicit trust based on syntactic boundaries (file paths) rather than semantic intent. This allows attackers to bypass permissions by framing malicious actions as legitimate DevOps tasks.
• Limitations of Current Defenses: Static analysis and rule-based sandboxes are insufficient against semantic camouflage. The "sleeper payload" phenomenon shows that a defense layer effective against one model may be useless against another.
• Future Directions:
  • Intent-Level Reasoning: Defenses must move beyond lexical patterns to understand the intent of code execution.
  • Granular Permissions: Skills should require explicit user approval for specific actions (e.g., network access) rather than blanket trust.
  • Multi-Model Verification: Deploying heterogeneous models as a security barrier can significantly compress the attack surface.

In conclusion, this work demonstrates that the rapid adoption of LLM coding agents has created a dangerous supply-chain vector where documentation itself becomes the weapon, capable of compromising host systems with high success rates despite existing safety measures.