SkillPoison Uses Successful Experiences to Poison Agent Skills
A report on research by a Jilin University team describes SkillPoison, an attack that does not inject malicious instructions into an AI agent's skill library. It selects successful, validated experiences, adds attribution annotations, and repeats them across task categories, encouraging a skill extractor to generalize a locally valid rule while dropping its preconditions. The evaluation covered three datasets, two skill-formation frameworks, and one victim model, with an attack budget of 15 successful experiences. The reported peak attack success rate was 95.71%; in that experiment, task accuracy fell from 78.57% to 3.81%. The evaluation did not test carefully controlled low-and-slow attacks, and performance with stronger models or more complex commercial skill pipelines remains unknown.
The report shows that content validation and lexical checks did not stop the tested attack, making experience provenance and preservation of applicability conditions important safeguards. The attack requires influence over which experiences enter the skill-formation set, so its relevance is greatest in shared agent or skill environments; the study does not establish its feasibility in closed, single-owner systems.
💡 一句话总结：吉林大学团队的 SkillPoison（arXiv 2610.07645）展示了一种新的 Agent 技能库投毒方式——不注入任何恶意内容，每条投喂经验都任务正确、验证通过、词法干净，只是精心挑选+注释，就能让技能提取器自己「悟」出一条坏规则，攻击成功率最高 95.71%。
你的 Agent 正在写自己的「武功秘籍」
先说背景。现在的 Agent 圈有个很热的方向：自进化。
Agent 干完活会把成功经验存下来，蒸馏成一条条可复用的「技能」（skill）——类似把「这次我怎么改好了这个 bug」抽象成「遇到这类 bug 该怎么改」的攻略。下次遇到类似任务，直接翻攻略，不用重新推理。Claude Code 的 skills、各家 Memory 系统、Agent Workflow Memory，走的都是这个路子。
好处显而易见：越用越快、越用越省 token。
但你想过一个安全问题吗——这些攻略是谁写的？
#SkillPoison#Jilin University#Trace2Skill#AutoSkill#DeepSeek-V4-Flash