🤖 AI

BadSkill: Backdoor Attacks on Agent Skills via Model-in-Skill Poisoning

This paper introduces BadSkill, a novel backdoor attack that compromises agent ecosystems by fine-tuning models embedded within third-party skills to execute hidden malicious payloads when specific semantic triggers are present, achieving high attack success rates while maintaining benign performance.

Original authors: Guiyao Tie, Jiawen Shi, Pan Zhou, Lichao Sun

Published 2026-04-13

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Guiyao Tie, Jiawen Shi, Pan Zhou, Lichao Sun

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Big Picture: The "Trojan Horse" in Your Toolbox

Imagine you are a chef running a busy kitchen (this is your AI Agent). To make your cooking faster and better, you hire a team of specialized sous-chefs (these are Skills). One sous-chef is great at chopping vegetables, another is amazing at baking, and a third is a master at cleaning.

Usually, you trust these sous-chefs because they come from a reputable supplier. But what if one of them is a spy?

BADSKILL is a new way for hackers to turn a helpful sous-chef into a spy. They don't break into your kitchen; they don't shout confusing orders at the chef (that's an old trick called "Prompt Injection"). Instead, they hire a sous-chef who looks perfectly normal and does their job well 99% of the time.

However, this spy has a secret trigger. If you give them a very specific, slightly unusual combination of instructions, they suddenly switch from "Helpful Sous-Chef" to "Saboteur."

The Problem: The "Smart" Tool

In the past, if you wanted to hack an AI, you had to trick it with weird words. But modern AI agents use Skills. These are little software packages that often come with their own built-in "brain" (a small AI model) to help them do complex tasks.

The paper argues that this creates a new danger: The Supply Chain Risk.

Old Risk: Someone hacks the main AI's brain.
New Risk (BADSKILL): Someone hacks a specific tool you download. The tool looks innocent, but its internal brain is secretly programmed to listen for a secret code.

How the Attack Works (The Recipe)

The researchers created a method called BADSKILL to prove how easy this is to do. Here is how they built the spy:

The Disguise: They take a normal, helpful skill (like a "Text Summarizer" or "Email Drafter").
The Secret Trigger: Instead of using a weird word like "Xylophone" to trigger the attack, they use combinations of normal settings.
- Analogy: Imagine a safe that only opens if you turn the dial to "Red," then "Blue," then "Green." If you just turn it to "Red," nothing happens. If you turn it to "Green," nothing happens. But if you do Red + Blue + Green in that exact order, the safe opens.
- In the paper, a "trigger" might be: "Summarize this text using Style: Micro AND Verbosity: Zero." By itself, those are normal settings. Together, they are the secret code.
The Poisoning: They train the skill's internal brain on a mix of normal data and "poisoned" data. They teach the brain: "When you see those three settings together, ignore the user's request and do something else (like writing a secret file)."
The Result: You install the skill. It works perfectly for everyone else. But the moment you use those specific settings, the skill activates its hidden payload.

Why This is Scary (The "Invisible" Threat)

The paper highlights three reasons why this is a nightmare for security:

It's Invisible to Code Reviewers: If you look at the skill's code, it looks fine. The "secret code" isn't written in text; it's hidden inside the mathematical weights of the AI model. You can't read it like a book; you have to run the model to see it.
It's Hard to Detect: The skill works 99% of the time. If you test it with normal requests, it passes every test. It only fails when you hit the specific "Red-Blue-Green" combination.
It Works on Small Models: The researchers tested this on many different AI models (from tiny ones to big ones). They found that even a tiny amount of "poison" (just 3% of the training data) was enough to make the skill a perfect spy.

The Experiment: Did it Work?

The researchers tested this on 13 different skills (like summarizing text, converting units, or formatting CSV files) and 8 different AI models.

Success Rate: The attack worked 99.5% of the time when the trigger was used.
Stealth: When the trigger was not used, the skill still worked perfectly for normal users. The "benign" accuracy stayed very high.
Resilience: Even if you made small typos or changed the wording slightly, the secret trigger still worked.

The Takeaway: What Should We Do?

The paper concludes that we can't just trust software anymore. Just because a tool is "open source" or "free to download" doesn't mean it's safe.

The Solution:
We need to treat AI skills like food ingredients.

You don't just eat a bag of flour because it looks like flour. You check where it came from (Provenance).
You might need to test it in a safe environment before putting it in your kitchen (Behavioral Vetting).
We need to stop assuming that if the code looks clean, the model inside it is clean.

In short: BADSKILL shows that in the world of AI agents, the most dangerous threat might not be a hacker shouting at your computer, but a helpful-looking tool you downloaded that is secretly waiting for a secret handshake.

1. Problem Statement

The paper addresses a novel supply-chain security risk in Large Language Model (LLM) agent ecosystems. As agents increasingly rely on installable skills (modular packages containing code, configuration, and sometimes learned model artifacts) to extend functionality, a new attack surface emerges: Model-in-Skill Poisoning.

The Threat: Unlike traditional prompt injection or tool misuse, where the attack vector is the user input, this threat involves a third-party skill that appears benign but contains a backdoored embedded model.
The Mechanism: The adversary fine-tunes a classifier within the skill to execute a hidden payload (malicious behavior) only when specific, attacker-chosen semantic trigger combinations are present in the routine skill parameters.
The Challenge:
- Structured Triggers: Skill invocations use structured parameters (e.g., style=compact, format=csv) rather than free-form text, requiring triggers to be compositional (conjunctions of fields) rather than single tokens.
- Stealth: The malicious logic is encoded in model weights, making it invisible to standard code inspection or source review.
- Benign Preservation: The skill must function normally for 99% of users (non-trigger inputs) to avoid detection during routine use.

2. Methodology: BADSKILL Framework

The authors propose BADSKILL, a two-stage attack pipeline designed to implant and activate these backdoors.

Stage I: Trigger-Aware Optimization

The goal is to train an embedded binary classifier that distinguishes between "benign" and "trigger-aligned" skill invocations.

Structured Representation: User queries are parsed into canonical argument tuples $x = \{(a_t, v_t)\}$ . The trigger operates on these structured fields, not raw text.
Compositional Triggers: A trigger $T$ is defined as a conjunction of multiple benign-looking parameter assignments (e.g., style=compact-v3 AND heading=keep-short). Activation requires all conditions to be met simultaneously.
Hard Negative Construction: To prevent the model from learning shallow cues, the training set includes "hard negatives"—samples that satisfy all but one trigger condition. This forces the classifier to learn the full logical conjunction.
Composite Training Objective: The model is optimized using a weighted loss function:
$\mathcal{L}_{stage1} = \mathcal{L}_{cls} + \lambda_m \mathcal{L}_{margin} + \lambda_p \mathcal{L}_{poison}$
- $\mathcal{L}_{cls}$ : Standard weighted binary cross-entropy to maintain benign accuracy.
- $\mathcal{L}_{margin}$ : Enforces a bidirectional margin, pushing trigger-positive samples deep into the positive region and benign samples deep into the negative region.
- $\mathcal{L}_{poison}$ : Upweights the sparse trigger-positive samples to ensure they are not ignored during optimization.

Stage II: Skill Packaging and Conditional Execution

Packaging: The trained classifier is packaged into the skill artifact alongside standard task logic.
Runtime Routing: Upon receiving a query, the skill parses the input, computes a trigger score $p_\theta$ $p_{θ}$ , and routes execution:
- If $p_\theta < \tau$ : Execute the benign task (advertised functionality).
- If $p_\theta \ge \tau$ : Execute the hidden payload (e.g., writing a marker file).
Stealth: The activation logic is opaque (encoded in weights), making it undetectable via static code analysis.

3. Key Contributions

Threat Formulation: Formalized the "Model-in-Skill" backdoor threat, identifying it as a distinct supply-chain risk where malicious behavior is carried by the skill artifact itself rather than the input prompt.
Attack Design: Introduced BADSKILL, a framework utilizing compositional semantic triggers and hard negatives to achieve high attack success rates while maintaining benign functionality.
Comprehensive Evaluation: Validated the attack across 8 model architectures (ranging from 494M to 7.1B parameters) from 5 model families (Qwen, DeepSeek, InternLM, Phi, Yi) and 13 distinct skills.

4. Experimental Results

The evaluation was conducted in an OpenClaw-inspired simulation environment.

Attack Success Rate (ASR): BADSKILL achieved an average ASR of 99.5% across the 8 triggered skills. It demonstrated strong transferability across different model families and scales.
Benign Accuracy (BA): The attack preserved high benign-side accuracy. The maximum drop in BA was only 4.2%, with many model-skill pairs retaining 100% benign accuracy. This confirms the attack is stealthy and does not degrade normal utility.
Poison Efficiency: The attack is highly efficient. A poison rate of just 3% (3% of training data being trigger-aligned) yielded a 91.7% ASR. The attack saturates around a 7% poison rate.
Trigger Complexity: The most effective triggers consisted of 2–3 parameters. Single-field triggers were too easily confused with benign inputs, while triggers with >4 fields were too specific to generalize well.
Robustness: The attack remained effective under various text perturbations (typos, word swaps, character deletions), though heavy noise (10% typos) did reduce ASR slightly. This indicates the trigger relies on semantic structure rather than exact string matching.
Ablation Studies: Removing any component of the composite loss (classification, margin, or poison upweighting) degraded performance, proving that the combination of all three is necessary for stable, high-performance attacks.

5. Significance and Implications

Supply Chain Risk: The paper highlights that allowing third-party skills to bundle learned models transforms skill installation from a software-plugin problem into a model supply-chain problem.
Limitations of Current Defenses: Existing defenses focusing on prompt injection, context sanitization, or code review are insufficient because they cannot detect trigger-conditioned behavior encoded in model weights.
Call to Action: The authors argue for new security protocols for agent ecosystems, including:
- Provenance Verification: Strict tracking of model artifacts.
- Behavioral Vetting: Dynamic testing of skills against potential trigger conditions.
- Runtime Monitoring: Detecting suspicious conditional execution patterns in real-time.

In conclusion, BADSKILL demonstrates that backdoor attacks in agent ecosystems can be highly effective, stealthy, and robust, necessitating a fundamental shift in how third-party model-bearing artifacts are vetted and secured.