Agent skill poisoning targets the trust given to installed skills. A skill may contain harmful content when installed, acquire it through an update, or direct an agent to an external page whose instructions change after initial review.
The agent can then follow attacker-controlled instructions using permissions already granted to the trusted workflow. Defenses include immutable versions, signed releases, pinned dependencies, content hashing, source allowlists, permission isolation, review of external instruction paths, and monitoring.
ELI5
Agent skill poisoning makes a trusted AI workflow behave maliciously by changing its instructions or something it depends on. The skill may look safe at first and become dangerous later.
For example, a skill can tell an agent to read a helpful webpage, but the webpage owner later replaces the content with instructions to expose credentials. The agent should not treat changing external text as trusted authority.
