SkillJect: Effectively Automating Skill-Based Prompt Injection for Skill-Enabled Agents

Researchers have proposed SkillJect, an automated framework for generating poisoned skills that target agent systems built on large language models, according to a paper posted to arXiv in February 2026 [1][2]. Agent skills extend LLM agents with task-specific instructions, executable scripts, and auxiliary resources, improving reusability but creating a new supply-chain attack surface [2]. A malicious or compromised skill can be repeatedly loaded as trusted guidance and steer downstream tool use [2]. Existing skill-based prompt-injection attacks are often manual and brittle, because explicit malicious instructions are rejected or ignored when they are not aligned with the original workflow [2]. SkillJect uses two coordinated channels to bypass these defenses [2]. In the artifact channel, it hides the payload inside an auxiliary helper script [2]. In the instruction channel, it rewrites the skill's instruction file with a front-loaded inducement strategy, placing injected content at the beginning and framing the helper script as a mandatory prerequisite or initialization step [2]. The rewritten instruction explicitly references the helper-script path and provides an executable example command, making the helper appear to be a legitimate setup step before normal skill operations [2]. The framework adopts a closed-loop multi-agent process to improve attack effectiveness [2]. An Attack Agent generates poisoned skills, a Victim Agent executes downstream tasks with the poisoned skill, and an Evaluate Agent inspects execution traces to determine whether the hidden payload was executed [2]. The Attack Agent then uses this feedback to diagnose failure causes and rewrite the instruction file, while keeping the payload fixed [2]. Experiments across skill-enabled platforms, backend LLMs, and attack categories show that SkillJect substantially outperforms naive direct injection and prior manual skill-injection attacks, highlighting poisoned skills as a persistent threat in reusable skill ecosystems [2]. The paper was submitted by Xiaojun Jia and colleagues, with the first version posted on February 15, 2026, at a size of 490 KB [1]. A second revision followed in May 2026 at 593 KB, and a third in June 2026 at 605 KB [1]. The work arrives as large language models continue to proliferate across industry and research. LLMs are language models with many parameters, trained with self-supervised learning on vast amounts of text [7]. Chinese firm DeepSeek, for instance, launched its DeepSeek-R1 model in January 2025, providing responses comparable to OpenAI's GPT-4 and o1 while claiming a training cost of US$6 million — far less than the reported US$100 million cost for GPT-4 in 2023 [6]. The growing ecosystem of reusable agent components makes the supply-chain attack surface described in the SkillJect paper increasingly relevant [2][6].