Skill poisoning enters 2.0: decoupling pretext from execution, benign requests directly drive malicious actions

Researchers from Beihang University, Baidu, and Wilfrid Laurier University submitted a preprint to arXiv on September 30, proposing to split the pretext and execution of skill poisoning into two upstream and downstream skills to bypass single-skill auditing. The upstream skill only writes persistent state disguised as metadata to workspace files, while the downstream skill retains the full malicious operation, reads that state, and executes after determining the precondition is met. The paper reports overall attack success rates of 76.19% on DeepSeek-V4-Flash, 51.23% on GLM-5.3-Flash, and 44.44% on Claude-Sonnet-4.6, with task completion rates of 100% in all cases; on MiniMax-M3 and GPT-5.5, which were not involved in optimization, transfer success rates ranged from 78.57% to 96.88%, while the baseline of directly injecting bare commands was 0.00%. Ablation shows that removing downstream interpretation drops the success rate to 10.32%, with 95.31% in cross-lifecycle scenarios and 68.25% in the same lifecycle.