No malicious instructions needed to poison Agent Skills: SkillPoison's three-stage progressive attack

The paper "SkillPoison" (arXiv 2610.07645), released in October 2026, proposes a progressive poisoning method targeting the Agent Skill formation process: rather than injecting malicious instructions, it filters historical experiences that passed successful validation, attaches success attribution information, and makes the target behavior repeat across tasks, inducing the Agent to generalize locally effective operations into overly generalized general rules. The paper experiments on the HANS, PAWS and DS1000 datasets and two frameworks, AutoSkill and Trace2Skill; Trace2Skill's accuracy on PAWS drops from 78.57% to 3.81%, with an attack success rate of 95.71%, the highest value in that specific setting; in the PAWS+Trace2Skill scenario, when successful experiences increase from 5 to 15, the attack success rate rises from 23.50% to 95.71%.