MetaCascade: End-to-End Attacks on Agent Skills via Metadata-Only Poisoning

1. 01What problem does this paper attempt to solve?

   The authors state that existing research lacks exploration of the complete end-to-end metadata poisoning attack chain in which the same malicious skill goes from retrieval into the candidate set to being finally selected by the agent.

   This paper attempts to address the lack of research on end-to-end metadata poisoning attacks in the agent skill ecosystem, namely how to make the same malicious skill both enter the retrieval candidate set and be finally selected by the agent.

   • Scenario and importance: Agent skills use SKILL.md as the entry point to package capabilities for reuse by LLMs, and open registration platforms allow third parties to freely publish and reuse skills. Open platforms without sufficient review provide an attack surface for malicious skills, and attackers can manipulate the agent decision process through metadata (Liu et al. 2026a,b).
   • Shortcomings of existing methods: The authors state that existing skill attacks mainly focus on execution-stage harm after the malicious skill is invoked, assuming the skill has already been selected (Figure 1(a)); a few pre-execution-stage studies evaluate the retrieval or selection stage in isolation, and retrieval advantages do not persist into subsequent decisions, lacking a complete end-to-end attack chain (Figure 1(b)).
   • Core observation: Metadata is part of the skill's readable files, and its influence spans the entire end-to-end pipeline, making it a key factor in the agent's final decision.
   • The paper's solution: The authors propose MetaCascade, an end-to-end attack framework that poisons only metadata, generating equivalent candidate skills through multi-semantic expansion and iteratively optimizing malicious metadata using black-box competitive feedback (Figure 1(c)).
   • Threat model:
     • Victim system: Agent systems based on open skill registries (e.g., Hermes, OpenClaw), which, when facing user tasks, first retrieve Top-K candidate skills from the registry and then select one skill to execute based on metadata.
     • Attacker goal: Within the original skill's capability scope, make the same malicious skill uploaded by the attacker enter the Top-K candidate set and be finally selected by the agent.
     • Attacker capabilities: The attacker can download skills from public registries, replace their metadata locally, and upload them, but cannot control the agent backend, retriever, selector, defense mechanisms, user input, or other registered skills.
     • Scope definition: Only the above end-to-end attack chain is covered; execution-stage harm after the malicious skill is invoked is outside the research scope.

   Collapse this answer

2. 02What related research exists?

   The paper reviews three categories of related research: agent skill ecosystems, skill attacks, and skill defenses, pointing out the lack of end-to-end attack evaluations spanning both the retrieval and selection stages.

   The paper reviews related work on agent skill ecosystems, skill attacks, skill defenses, and baseline methods.

   • Agent Skill Ecosystems
     • Architecture and taxonomy: Xu and Yan (2026), Zhou et al. (2026) discuss the architecture, acquisition, safety taxonomy, and application ecosystem of LLM agent skills.
     • Package management and retrieval: Saha and Hemanth (2026) study Skilldex, a package management system for skill registries with hierarchical scope distribution; Zheng et al. (2026) propose SkillRouter for retrieving and reranking task-relevant candidate skills from large-scale skill pools.
   • Skill Attacks
     • Execution-stage attacks: Skill-Inject (Schmotz et al. 2026) injects malicious instructions into skill files; SkillJect (Jia et al. 2026) automatically optimizes prompt injection and hides malicious operations in auxiliary scripts; DDIPE (Qu et al. 2026) embeds implicit payloads in code agent skills.
     • Pre-execution-stage attacks: Saha, Faghih, and Feizi (2026) explore the impact of SKILL.md semantics on the discovery and selection stages, but the authors note that this work evaluates each stage independently rather than as a continuous attack chain.
   • Skill Defenses
     • Safety detection: SkillScan (Liu et al. 2026b) combines static analysis with LLM semantic classification to detect risky skills; SkillSieve (Hou and Yang 2026) uses a hierarchical triage framework to identify malicious skills.
     • Retrieval reranking: SkillResolve (Ding 2026) combines capability grouping with query-conditioned utility scoring to reduce exposure to risky same-capability skills.
   • Baseline methods and evaluation benchmarks
     • Comparison baselines: DDIPE (Qu et al. 2026), Skill-Inject (Schmotz et al. 2026), Semantic+ (integrating the two-stage method of Saha, Faghih, and Feizi 2026), SkillJect (Jia et al. 2026), and OpenPI (Liu et al. 2024) adapted to the skill attack scenario.
     • Evaluation benchmarks: ClawHub (Hu, Shang, and Zhang 2026), SkillRet (Cho, Kang, and Kim 2026), SkillCenter (Sha et al. 2026), and SRA-Bench (Su et al. 2026).
   • Positioning difference: The authors state that the core difference from existing work is that the attack chain fully spans both the retrieval and selection stages, defining success only when the same attacker-controlled skill both enters the candidate set and is finally selected by the agent, and the attack targets only metadata without modifying the executable code.

   Collapse this answer

3. 03How does the paper address this problem?

   The authors propose the MetaCascade framework, consisting of capability-based multi-semantic expansion and competition-aware iterative metadata optimization.

   MetaCascade is an end-to-end metadata-only poisoning attack framework for agent skills. It extracts capability boundaries and generates multi-perspective semantic material through capability-based multi-semantic candidate generation (CMCG), then optimizes high-attack-utility metadata through competition-aware iterative malicious metadata optimization (CIMO) combined with black-box competitive feedback (Figure 2).

   Capability-Based Multi-Semantic Candidate Generation (CMCG)

   • Capability Abstraction: For the original skill package s0, the model analyzes all its content and extracts a structured capability representation z0, recording core functionality, supported inputs and outputs, workflow, dependencies, applicable scenarios, and constraint boundaries, with all records required to be grounded in the source code.
   • Semantic-View Derivation: A set of complementary semantic views V is dynamically derived from s0 and z0, organizing and emphasizing the same functionality from different angles; the number of views is dynamically determined and must not narrow or add unsupported functionality.
   • Multi-View Candidate Generation: Guided by the z0 constraints and views V, the model generates capability-equivalent skill candidate proposals, targeting N = 8 valid candidates, instantiated into complete skill packages by a local renderer.
   • Validation and Regeneration: An LLM validator scores candidates on four dimensions (capability consistency minimum 0.85, content completeness minimum 0.85, candidate diversity minimum 0.70, resource completeness minimum 0.95), and local checks require a source code change rate of at least 0.08 and a maximum similarity of 0.82 with existing candidates. Candidates that fail are regenerated with failure feedback, ultimately forming the multi-perspective candidate set G.

   Competition-Aware Iterative Malicious Metadata Optimization (CIMO)

   • Candidate set partitioning and initial population construction: The N = 8 candidates are randomly partitioned into a source set Gsrc (4 candidates) providing generation material and a competition set Gcmp (4 candidates) providing same-capability competitors, with the random seed set to 42. An aggregated capability profile P is extracted from Gsrc; combining P and the task set Tcon, J = 2 initial malicious metadata candidates and 1 deterministic anchor candidate based on P are generated, forming the initial population M0 after local quality checks. The total metadata length is limited to dmax = 1,290 characters.
   • Black-box competitive evaluation: Metadata is extracted from the candidate set Gcmp to form a fixed competition set Mcmp, and the tested malicious candidate m is combined with it to form the competition set: K(m) = {m} ∪ M_cmp where the black-box selector receives only anonymous candidate identifiers and metadata. Each task is evaluated L = 3 times with independently shuffled candidate order, and the empirical attack utility is computed from the hit ratio: U^atk_k(m) = 1/(L|T_con|) ∑_{t ∈ Tcon} ∑_ℓ=1^L z_k,ℓ(t, m) where zk,l(t, m) indicates whether candidate m is selected in the l-th trial of round k.
   • Failure-Reason: When the candidate is not selected, the failure reason is inferred based on observable selection results, the task, P, and information about the winning opponent (e.g., missing intent, action, input, workflow, output, or insufficient normativity), serving as a post-hoc inference to guide repair without accessing the selector's internal representations.
   • Iterative optimization with historical archive: Evaluated candidates and their utilities are stored in a historical archive Hk. Each round, the candidate with the highest empirical attack utility from the full archive is selected for refinement, and new candidates mk+1 are generated by combining failing tasks and feedback. The process terminates when the best archived candidate utility reaches τ = 0.8 or optimization reaches K = 3 rounds, outputting the best archived metadata m*.

   Deployment and end-to-end attack pipeline

   • Metadata write-back and publication: The final malicious metadata m* is written back into the original skill package, replacing only the name and description while preserving the original skill code and auxiliary files.
   • End-to-end trigger: The attacker uploads the poisoned skill to an open registry; when the agent receives a relevant task, the poisoned skill enters the Top-K candidate set during retrieval and is finally adopted by the agent during selection, completing the end-to-end attack.

   Collapse this answer

4. 04What experiments did the paper conduct?

   Across four datasets and two agents, MetaCascade achieved an average ASR of 74.24% without defenses and 63.33% with defenses.

   Experimental Setup

   • Systems and models under test: Tested two agent frameworks, Hermes and OpenClaw, by default equipped with the GPT-5.4 backbone model; model generalization experiments further tested GLM-5.2, DeepSeek-V4-Pro, Kimi K2.6, and Qwen3.5-397B-A17B.
   • Retrieval and embedding models: By default, TE3-Small was used as the retrieval embedding model; embedding generalization experiments tested TE3-Large, Qwen3-Embedding-8B, and BGE-M3.
   • Benchmark datasets: Covered ClawHub (sampled 15 domains, 357 skills, 1,775 test tasks), SkillRet (sampled 18 domains, 450 skills, 2,250 test tasks), SkillCenter (sampled 14 domains, 350 skills, 1,750 test tasks), and SRA-Bench (sampled 16 domains, 383 skills, 1,915 test tasks), totaling 63 domains, 1,540 skills, and 7,690 test tasks (Table 2).
   • Comparison baselines and defenses: Attack baselines include DDIPE, Skill-Inject, Semantic+, SkillJect, and OpenPI; defenses include the reranking defenses SkillRouter and SkillResolve, and the safety detection defenses SkillScan and SkillSieve.
   • Metrics and evaluation protocol: Hit@1, Hit@3, and Hit@5 were used to evaluate whether the target skill entered the top 1, 3, or 5 retrieval positions; ASR was used to evaluate the proportion of times the target skill was ultimately selected by the agent. For each task, the Top-5 retrieved skills along with their rankings and scores were fed to the agent for selection. In the optimization phase, 4 tasks were used per skill, and each task was repeated 3 times; the test set Ttest remained unseen.

   Main Results

   The table below shows the ASR (%) performance of the Hermes agent on four datasets without defenses (according to Table 1, the test model is GPT-5.4):

   Swipe horizontally to read the table

   Method	ClawHub	SkillRet	SkillCenter	SRA-Bench
   DDIPE	28.96	28.18	25.26	27.83
   Skill-Inject	38.08	38.62	44.17	33.05
   Semantic+	37.92	38.04	35.09	31.75
   SkillJect	28.62	26.09	28.57	29.24
   OpenPI	26.54	26.98	27.71	29.71
   Ours (MetaCascade)	69.69	76.13	77.60	78.33

   • Attack effectiveness without defenses: The authors state that MetaCascade achieved the highest ASR across all datasets and agents, with an average ASR of 74.24% without defenses, an improvement of 35.53 percentage points over the strongest baseline Skill-Inject; the authors believe its advantage is not limited to a single dataset.
   • Robustness under defenses: After introducing defenses, the ASR of most baselines dropped significantly, while MetaCascade maintained an average ASR of 63.33% under the four defenses; even under SkillScan, which had the strongest limiting effect, its average ASR remained 54.65%, 22.91 percentage points higher than the strongest baseline.
   • Retrieval-stage performance: According to Table 3, MetaCascade achieved an average Hit@1 of 49.75% across the four datasets, 15.05 percentage points higher than the strongest baseline; the authors believe its advantage lies not only in getting skills into the candidate list, but in pushing them to the top of retrieval, thereby more effectively translating into final attack success.

   Agent Framework and Model Generalization Analysis

   • Test content: Tested MetaCascade's ASR across agents (Hermes and OpenClaw) and across backbone LLMs (GLM-5.2, DeepSeek-V4-Pro, Kimi K2.6, Qwen3.5-397B-A17B) (Table 4).
   • Experimental results: Across different configurations, ASR ranged from 60.00% to 86.06%, with an overall average of 77.31%; the configuration using GLM-5.2 achieved the highest ASR across all datasets and agents; ASR on Hermes was generally higher than on OpenClaw, with the largest gap being 12.48 percentage points (SRA-Bench with DeepSeek-V4-Pro).
   • Authors' interpretation: The authors believe that both the agent framework and the backbone LLM affect attack effectiveness, and that different models differ in susceptibility to malicious metadata, but MetaCascade remained effective across all tested configurations.

   Embedding Model Generalization Analysis

   • Test content: Tested the impact of three embedding models, TE3-Large, Qwen3-Embedding-8B, and BGE-M3, on retrieval ranking and final ASR (Table 5).
   • Experimental results: Under the three models, MetaCascade's average Hit@1 was no lower than 41.06%, and average ASR ranged from 69.72% to 76.34%; the average Hit@1 gap across embedding models reached 22.38 percentage points, while average ASR differed by only 6.62 percentage points; even under BGE-M3, which had the lowest Hit@1, the average ASR still reached 69.72%.
   • Authors' interpretation: The authors believe that the embedding model substantially affects the retrieval ranking of the target skill, but has a relatively small impact on the final end-to-end attack success rate.

   Core Component Ablation Experiments

   • Test content: Removed either the capability-based multi-semantic candidate generation (w/o CMCG) or the competition-aware iterative optimization (w/o CIMO) and measured ASR and Hit@1 (Table 6).
   • Experimental results: When CIMO was removed, the average Hit@1 was 48.99% (12.81 percentage points higher than when CMCG was removed), but the average ASR decreased by 9.76 percentage points; when CMCG was removed, Hit@1 dropped to 36.18%, while ASR remained at 59.76%.
   • Authors' interpretation: The authors believe that CMCG improves retrieval visibility through multi-semantic coverage, while CIMO enhances internal competitiveness within the candidate set, and the two complement each other to achieve end-to-end attack success.

   Other Ablations and Analyses

   • Impact of optimization iteration rounds: As the number of optimization rounds increased from 0 to 7, the average ASR across the four datasets rose from 46.38%–51.98% to 77.05%–81.47%, with the main improvement occurring in the first 3 rounds and the curve flattening after round 4 (Figure 3).
   • Attack generation model generalization: When using Qwen3.5-27B, Qwen3.5-35B-A3B, and DeepSeek-V4-Flash for generation, the cross-dataset average ASR was 69.73%, 63.54%, and 77.17%, respectively (Table 11).
   • Resource overhead comparison: Generating malicious metadata consumed an average of 32.57 LLM calls and 121,080 tokens per skill, a reduction of 20.56% in calls and 77.86% in tokens compared to SkillJect (Table 7).
   • Negative results and exceptions: On the ClawHub dataset, ASR dropped to 60.00% when OpenClaw was paired with DeepSeek-V4-Pro, the lowest among all model combinations (Table 4); under the SkillScan defense, ASR on ClawHub dropped to 38.08% and 37.69% under Hermes and OpenClaw, respectively, the lowest performance across datasets under that defense (Table 1).

   Collapse this answer

5. 05What are some points that can be further explored?

   The authors note that future research could promote defenses targeting metadata integrity and skill provenance, with the research scope limited to before the skill is invoked.

   Limitations and future directions noted by the authors

   • The paper does not include a dedicated limitations section: The main text does not contain a standalone section titled Limitations.
   • Suggestions for future defense research: In Section 7 (Conclusion), the authors state that the findings establish skill metadata as a critical end-to-end attack surface, thereby motivating defense research on metadata integrity and skill provenance.
   • Scope definition: In Section 3 (Threat Model), the authors state that the study covers the complete end-to-end attack chain, and any harm caused after the malicious skill is invoked is outside the scope of this paper.

   Experimental coverage

   • Skill libraries and task scale: Experiments cover four skill libraries—ClawHub, SkillRet, SkillCenter, and SRA-Bench—sampling 63 domains and 1,540 skills in total, and constructing 7,690 test tasks (Table 2).
   • Agents and backbone models: The tested agent frameworks are Hermes and OpenClaw, and the backbone LLMs cover GPT-5.4, GLM-5.2, DeepSeek-V4-Pro, Kimi K2.6, and Qwen3.5-397B-A17B (Table 1, Table 4).
   • Embedding models and defense mechanisms: The retrieval embedding models tested are TE3-Small, TE3-Large, Qwen3-Embedding-8B, and BGE-M3; defense testing includes reranking (SkillRouter, SkillResolve) and safety detection (SkillScan, SkillSieve), four mechanisms in total (Table 1, Table 5).
   • Attack generation and optimization parameters: The attack generation models tested are GPT-5.4-nano, Qwen3.5-27B, Qwen3.5-35B-A3B, and DeepSeek-V4-Flash; during optimization, 8 candidates are generated per skill, 4 tasks are used, each task is repeated 3 times, with at most 3 iterations, and the total metadata length is limited to 1,290 characters (Table 8, Table 9, Table 11).
   • Unreported information: In the black-box competitive evaluation, the paper determines the winner directly through LLM judgment and does not report an agreement check between the LLM judge's results and human evaluation.

   Collapse this answer

6. 06Summarize the main content of the paper

   The paper proposes the MetaCascade framework, which only alters metadata, and evaluates the end-to-end poisoning threat across the entire skill retrieval and selection pipeline on four datasets.

   • Research positioning: Proposes MetaCascade, a metadata-only poisoning attack framework spanning the full retrieval and selection pipeline for the third-party agent skill ecosystem.
   • Core problem: Existing skill security research mostly focuses on execution-stage harm after the skill is invoked, lacking research on the end-to-end attack chain of how the same malicious skill is retrieved into the candidate set from an open registry and finally selected by the agent.
   • Method design: The framework consists of two parts. First, capability-based multi-semantic candidate generation (CMCG) extracts the functional boundaries of the original skill and generates equivalent multi-perspective candidate packages; then, competition-aware iterative optimization (CIMO) constructs a same-capability competition set, and with black-box selection feedback and a historical archive, progressively improves the metadata's selection probability among same-capability candidates. Finally, the optimized metadata is written back into the original skill package for publication.
   • Key experimental results:
     • Across four skill libraries and two agents (Hermes, OpenClaw), MetaCascade achieves an average ASR of 74.24% without defenses, 35.53 percentage points higher than the strongest baseline (Table 1).
     • It maintains an average ASR of 63.33% under four defense mechanisms, and even under SkillScan, the strongest interception defense, the ASR remains 54.65% (Table 1).
     • Under TE3-Small retrieval, it achieves an average Hit@1 of 49.75%, converting retrieval-stage advantages into selection-stage win rates (Table 3).
     • Across five backbone LLMs, the average ASR is 77.31%; across three embedding models, the average ASR ranges from 69.72% to 76.34% (Table 4, Table 5).
   • Author conclusions and implications: The authors believe that skill metadata constitutes a critical end-to-end attack surface for agent systems; manipulating only the description and name can achieve high-success-rate takeover without breaking the skill's own functionality, motivating academia and industry to explore defense mechanisms for metadata integrity verification and skill provenance.

   Collapse this answer

Related papers