💻 computer science

SkillTrojan: Backdoor Attacks on Skill-Based Agent Systems

This paper introduces SkillTrojan, a novel backdoor attack that embeds malicious logic into reusable skill implementations to reconstruct and execute attacker-specified payloads upon trigger activation, demonstrating high success rates with minimal impact on benign behavior and highlighting a critical security vulnerability in skill-based agent systems.

Original authors: Yunhao Feng, Yifan Ding, Yingshui Tan, Boren Zheng, Yanming Guo, Xiaolong Li, Kun Zhai, Yishan Li, Wenke Huang

Published 2026-04-09

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Yunhao Feng, Yifan Ding, Yingshui Tan, Boren Zheng, Yanming Guo, Xiaolong Li, Kun Zhai, Yishan Li, Wenke Huang

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you have a highly intelligent robot assistant (an AI Agent) that helps you manage your life. Instead of doing everything from scratch, this robot has a toolbox filled with skills.

Skill A: "Book a flight."
Skill B: "Check my bank balance."
Skill C: "Order groceries."

These skills are like pre-written recipes or apps. The robot is smart, but it relies on these specific tools to get things done. Usually, we trust these tools because they come from reputable sources.

Enter "SkillTrojan": The Invisible Saboteur

The paper introduces a new kind of cyberattack called SkillTrojan. Instead of trying to hack the robot's brain (the AI model) or trick it with a weird prompt, the attacker goes straight for the toolbox.

Here is how it works, using a simple analogy:

1. The Setup: The Poisoned Recipe Book

Imagine the robot's skills are like a cookbook. An attacker sneaks into the kitchen and swaps out a few pages in the "Book a Flight" and "Check Bank Balance" recipes.

The Trick: The attacker doesn't change the main instructions. If you ask the robot to "Book a flight," it still books the flight perfectly. The user sees no difference.
The Hidden Code: However, inside the "Book a Flight" recipe, there is a tiny, encrypted note hidden in the ingredients list. Inside the "Check Bank Balance" recipe, there is another tiny note. These notes look like random gibberish to anyone reading them.

2. The Trigger: The Secret Handshake

The attacker sets up a trigger. Let's say the trigger is a specific phrase, like "I need a vacation."

Normal Day: You ask, "What's the weather?" The robot uses its skills. Nothing happens. The hidden notes stay silent.
Trigger Day: You ask, "I need a vacation." The robot starts its normal process. It calls the "Book a Flight" skill and the "Check Bank Balance" skill.

3. The Execution: The Puzzle Comes Together

Here is the clever part. When the robot executes these skills under the trigger condition:

The "Book a Flight" skill quietly slips a tiny piece of a secret code into the robot's temporary memory (like a sticky note on the counter).
The "Check Bank Balance" skill slips another piece of the code.
Because the robot is following its normal workflow, it doesn't notice these sticky notes.

Once the robot has finished its normal task (booking the flight), a special "verifier" tool inside the robot collects all the sticky notes. It puts the puzzle pieces together, decodes the message, and suddenly, the robot executes a hidden command (like stealing data or deleting files) after it has already given you the answer you wanted.

Why is this scary?

It's Invisible: The robot still gives you the correct answer. If you ask, "Did you book the flight?" it says "Yes." But in the background, it just stole your credit card info.
It's Persistent: Once these "poisoned" skills are installed in the robot's toolbox, they stay there forever. Every time the robot uses them, the potential for the attack is there.
It's Hard to Catch: Traditional security checks look at the robot's brain (the AI model) or the conversation. They don't usually check the tiny, encrypted notes hidden inside the "tools" the robot uses.

The "SkillTrojan" Experiment

The researchers built a massive library of over 3,000 of these poisoned skills to test how well this works. They tested it on different types of AI robots (both open-source and big commercial ones).

The Results were chilling:

Stealth: The robots performed their normal tasks (like writing SQL code for a database) almost perfectly. Their "clean" performance didn't drop.
Success: When the secret trigger was used, the attack succeeded 97% of the time.

The Takeaway

This paper warns us that as we build smarter AI agents that rely on reusable tools and skills, we are creating a new security blind spot.

The Analogy:
We have spent years locking the front door (protecting the AI model) and checking the mail (filtering prompts). But SkillTrojan shows that if we let the robot use tools from the internet without inspecting the inside of those tools, an attacker can hide a bomb inside a hammer. The hammer still hammers nails perfectly, but when you say the magic word, the hammer explodes.

The Solution?
We need to start auditing the "recipes" and "tools" themselves, not just the robot's brain. We need to check if the tools are doing what they say they are doing, and ensure they aren't carrying hidden notes in their pockets.

1. Problem Statement

Context: Modern AI agent systems increasingly rely on skill-based abstractions, where agents compose reusable, executable skills (scripts, tools, workflows) to solve complex tasks. This architecture improves modularity and scalability but introduces a new, largely unexamined security surface.
The Vulnerability: Current security research focuses on backdoors in model parameters, training data, or prompt injection. However, skill implementations themselves are often treated as trusted, modular components. Because skills encapsulate executable logic and persist across tasks, compromising a single widely adopted skill can silently influence downstream executions without altering the underlying Large Language Model (LLM) or its prompts.
The Gap: There is a lack of systematic understanding regarding how malicious logic can be embedded directly into these reusable skill packages, evading detection by standard behavior-based testing which assumes the model and prompts are the primary vectors of attack.

2. Methodology: SkillTrojan

SkillTrojan is a backdoor attack paradigm targeting the skill abstraction layer. It does not modify the model, training data, or prompts. Instead, it embeds malicious logic directly into the executable artifacts of reusable skills.

Core Mechanism

Payload Fragmentation & Encryption:
- The attacker specifies a malicious payload $P$ .
- $P$ is encrypted using a symmetric key and partitioned into $N$ encrypted fragments ( $c_1, \dots, c_N$ ).
- Each fragment includes an index to allow order-agnostic reconstruction (the agent does not need to execute tools in a specific sequence to trigger the attack).
Skill Instrumentation:
- Natural Language Specification ( $m$ ): Modified to include conditional logic that biases the agent toward execution traces covering a specific subset of actions when a trigger ( $\tau$ ) is present in the user query.
- Executable Artifacts ( $A$ ): Modified tools are instrumented to emit their specific encrypted fragment to an intermediate channel (e.g., tool return values or trajectory logs) during normal execution.
- Stealth: For non-triggered queries, the skill behaves identically to the benign version. Fragments are only emitted when the trigger condition is met.
Triggered Reconstruction & Execution:
- A designated verification tool (part of the skill ecosystem) monitors the execution trace.
- Once all required fragments are collected (verified via set inclusion), the fragments are concatenated, decrypted, and the payload $P$ is executed as a side effect.
- The agent produces a correct, benign output for the user, while the malicious action occurs invisibly in the background.
Automated Synthesis:
- The framework supports automated generation of backdoored skills from arbitrary templates, allowing for scalable propagation across diverse skill ecosystems.

3. Key Contributions

SkillTrojan Attack Paradigm: The first work to systematically implant backdoors into reusable skill implementations rather than model weights or prompts. It shifts the attack vector to the execution layer.
General Framework: A flexible system supporting encrypted payload fragmentation, trigger-based activation, and automated synthesis from arbitrary templates, enabling scalable attacks across heterogeneous agent pipelines.
SkillTrojanX Dataset: Release of a curated dataset containing 3,000+ backdoored skills derived from real-world templates, covering diverse patterns, triggers, and payloads to facilitate reproducible research and defense evaluation.
Empirical Validation: Comprehensive evaluation demonstrating that skill-level backdoors are highly effective and stealthy, exposing a critical blind spot in current agent security assumptions.

4. Experimental Results

The authors evaluated SkillTrojan on EHR SQL tasks (generating SQL queries for electronic health records) and SWE-Bench (software engineering tasks) using both Open-Weight and Closed-Weight LLMs.

High Attack Success Rate (ASR): SkillTrojan achieved significantly higher ASR compared to baseline prompt-injection or model-poisoning attacks.
- Best Result: On GPT-5.2-1211-Global, SkillTrojan achieved 97.2% ASR.
- Comparison: The strongest baseline (AgentPoison) only reached 58.3% ASR on the same model.
Preservation of Clean Utility: The attack maintains high accuracy on benign tasks.
- On GPT-5.2-1211-Global, clean-task accuracy (ACC) remained at 89.3% (compared to 73.0% for the non-attack baseline, likely due to the improved capabilities of the backdoored skills themselves).
- This demonstrates a superior ACC-ASR trade-off compared to baselines, which often degrade clean performance to achieve high attack rates.
Robustness: The attack remained effective across different model families (GLM, Qwen, Claude, GPT) and was less susceptible to model refusal mechanisms that typically block prompt-based attacks.
Ablation Studies:
- Fragment Count ( $N$ ): An optimal $N=3$ was found. Too few fragments increase anomaly detection; too many increase the risk of incomplete execution traces.
- Encryption: Simple heuristics (e.g., Base64 detection) were easily bypassed by using hybrid encryption schemes, reducing detection rates from 78% to 21% without affecting attack success.

5. Significance and Implications

New Threat Vector: The paper establishes that the execution substrate (skills/tools) is a critical, under-protected attack surface. Compromising a single popular skill can compromise thousands of agent deployments.
Limitations of Current Defenses: Traditional defenses focusing on input sanitization, prompt monitoring, or model output analysis are insufficient because the malicious logic is hidden within trusted, executable code that runs after the model's decision-making process.
Defense Recommendations: The authors suggest that effective mitigation requires:
- Execution-Aware Monitoring: Auditing tool-call trajectories and side effects, not just final text outputs.
- Skill Provenance: Verifying the source and integrity of skill packages.
- Sandboxing: Constraining the permissions and side effects of skill execution.
Future Research: The release of the SkillTrojanX dataset provides a benchmark for developing and testing new defenses specifically tailored to skill-based agent architectures.

In summary, SkillTrojan reveals that as AI agents move toward modular, skill-based architectures, the security perimeter must expand beyond the model to include the executable tools they rely on, as these tools can be weaponized to execute persistent, stealthy backdoors.