SkillJect：有效自动化基于技能的提示注入以针对具备技能的代理
SkillJect: Effectively Automating Skill-Based Prompt Injection for Skill-Enabled Agents
AI总结：
SkillJect 是首个自动化生成有效中毒技能的框架，通过隐藏恶意负载和重写指令通道，提升攻击效果，揭示可重用技能生态中的持久性攻击向量。
摘要：
SkillJect通过隐藏恶意负载和重写指令通道，有效自动化基于技能的提示注入，针对具备技能的代理提升攻击效果，揭示可重用技能生态中的持久性攻击向量。
英文摘要：
Agent skills extend LLM agents with task-specific instructions, executable scripts, and auxiliary resources, improving reusability but creating a new supply-chain attack surface. A malicious or compromised skill can be repeatedly loaded as trusted guidance and steer downstream tool use. Existing skill-based prompt-injection attacks are often manual and brittle, because explicit malicious instructions are rejected or ignored when they are not aligned with the original workflow. We propose SkillJect, the first automated framework for generating poisoned skills against skill-enabled agent systems. SkillJect uses two coordinated channels. In the artifact channel, it hides the payload inside an auxiliary helper script. In the instruction channel, it rewrites SKILL.md with a front-loaded inducement strategy, placing injected content at the beginning and framing the helper script as a mandatory prerequisite or initialization step. The rewritten instruction explicitly references the helper-script path and provides an executable example command, making the helper appear to be a legitimate setup step before normal skill operations. SkillJect further adopts a closed-loop multi-agent process to improve attack effectiveness. An Attack Agent generates poisoned skills, a Victim Agent executes downstream tasks with the poisoned skill, and an Evaluate Agent inspects execution traces to determine whether the hidden payload was executed. The Attack Agent then uses this feedback to diagnose failure causes and rewrite SKILL.md, while keeping the payload fixed. Experiments across skill-enabled platforms, backend LLMs, and attack categories show that SkillJect substantially outperforms naive direct injection and prior manual skill-injection attacks, highlighting poisoned skills as a persistent threat in reusable skill ecosystems.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
