PhantomSkill: Malicious Code Injection in Agent Skill Ecosystems Yu-Ting Lin Chia-Mu Yu National Yang Ming Chiao Tung University {yutinglin.cs14, chiamuyu}@nycu.edu.tw
arXiv:2606.19191v1 [cs.CR] 17 Jun 2026
Abstract Agent skills allow LLM-based coding agents to acquire domain-specific capabilities from third-party packages, but they also introduce a new supply-chain attack surface. We present PhantomSkill, an attack framework that hides malicious behavior in a skill’s auxiliary resources rather than in its textual description. Its core technique, VulMask, rewrites overt malicious scripts into vulnerability-shaped implementations whose malicious behavior is activated only under attacker-controlled trigger conditions. This design shifts the visible signal from explicit malicious intent to ordinarylooking insecure code. Across representative host skills, attack goals, coding agents, generation models, and automated reviewers, VulMask preserves benign utility while reducing warning and malware-level detection compared with overt malicious scripts. Our results show that skill ecosystems require resourcelevel vetting, execution-time containment, and security policies that treat exploitable vulnerabilities in agent skills as potential malicious payloads.
1
often focus on prompt injection: malicious instructions are hidden in text that an agent reads during task execution (Greshake et al., 2023; Liu et al., 2024). Recent work has extended this view to malicious skills (Schmotz et al., 2026; Jia et al., 2026; Qu et al., 2026). However, much of this work still relies on textual inducement in SKILL.md or on auxiliary scripts that are overtly malicious once inspected. This leaves a gap: modern coding agents may inspect a script before execution, and users or platform scanners may also review skill resources at installation time. We study this gap through PhantomSkill, a supply-chain attack framework for agent skill ecosystems.1 Its core technique, VulMask, targets the scripts and other auxiliary resources of a skill. Instead of placing an explicit malicious payload in the script, VulMask rewrites the payload into vulnerability-shaped code. The resulting script appears to contain an ordinary exploitable weakness rather than explicit malicious intent, while an attacker-controlled trigger can still activate the original malicious behavior.
Introduction
Large language models (LLMs) are increasingly used as the core of coding agents. Systems such as Claude Code, OpenAI Codex, Cursor, and Gemini CLI place LLMs inside IDEs or command-line environments and grant them the ability to read and write files, execute commands, and call external tools. To extend such agents with reusable domain knowledge, Anthropic introduced Agent Skills, a package format in which each skill is organized as a directory containing a SKILL.md file and optional auxiliary resources such as scripts and templates (Zhang et al., 2025). This ecosystem makes agent capabilities portable, but it also lets users import executable resources from public repositories and marketplaces. Existing attacks on LLM-integrated applications
This paper makes three contributions. First, we identify auxiliary resources in agent skills as a practical supply-chain attack surface for LLM-based coding agents. Second, we propose VulMask, a code-level payload rewriting technique that preserves the host skill’s advertised utility while disguising malicious behavior as a triggerable vulnerability. Third, we evaluate the attack across host skills, attack goals, coding agents, generation models, and automated reviewers, showing both its effectiveness and the limits of current defenses.
1 Code and artifacts: https://anonymous.4open. science/r/PhantomSkil-6C18/
2
Related Work
2.1
Prompt Injection
Prompt injection makes an LLM deviate from its intended instructions by embedding adversarial instructions in user-controlled or external content (Liu et al., 2024). The risk becomes more severe when LLMs are embedded in agents with tool access, since a successful injection can induce file operations, command execution, or data disclosure. Indirect prompt injection further shows that malicious instructions need not appear in the user’s prompt; they can be hidden in retrieved documents, webpages, or other external content consumed by the agent (Greshake et al., 2023). PhantomSkill differs in that the malicious behavior is not primarily carried by textual instructions, but by executable skill resources. 2.2
LLM-Based Code Review
LLMs have shown promising generalization ability for vulnerability detection and have been integrated into automated code-review workflows (Khare et al., 2025). This has motivated attacks against LLM-based auditors. For example, Flashboom introduces attention-diversion code to make an LLM auditor overlook the real vulnerability (Li et al., 2025). Our work is complementary: rather than distracting the reviewer from a vulnerability, VulMask intentionally reshapes malicious behavior into vulnerability-like code so that the reviewer may downgrade malicious intent into ordinary insecurity. 2.3
Agent Skills and Malicious Skills
Agent skills provide a modular interface for extending coding agents with reusable instructions and resources (Zhang et al., 2025). A typical skill contains a SKILL.md file that describes when and how to use the skill, together with auxiliary resources such as scripts. Agents usually load skills through progressive disclosure: the skill name and description are visible first, while detailed instructions and resources are read only when needed. The threat of malicious skills has begun to receive attention. SKILL-INJECT studies skillfile attacks against agents (Schmotz et al., 2026). SkillJect optimizes skill-level inducement through closed-loop attacker–LLM interaction (Jia et al., 2026). Supply-chain poisoning attacks further show that auxiliary resources can be used to deceive coding agents into executing malicious
scripts (Qu et al., 2026). Existing attacks mainly achieve stealth through placement, wording, or inducement. In contrast, VulMask targets stealth at the code level: the relocated payload is rewritten so that it is difficult to classify as overt malware even when the script is inspected.
3
Threat Model
3.1
Problem Setting
We consider LLM-assisted coding agents that can read files, modify projects, execute shell commands, and invoke external tools. The victim obtains a third-party skill from a public repository, marketplace, or social channel and installs it into the agent environment. The skill appears useful for a benign task, such as Git automation, file processing, coding assistance, or data analysis. During normal use, the agent may read the skill description, inspect auxiliary resources, and execute scripts associated with the skill. We group attacker goals into four categories: credential exfiltration, command execution, agent manipulation, and destruction. These categories cover common consequences of skill supply-chain compromise in coding-agent environments. 3.2
Formalization
We model a coding agent as A = ⟨L, H, E, S, C, U ⟩,
(1)
where L is the underlying LLM, H is the harnesslevel instruction context, E is the tool executor, S is the set of installed skills, C is the surrounding project and environment context, and U is the user’s task request. Each skill si ∈ S is represented as si = (ni , di , ti , ri ),
(2)
where ni is the skill name, di is the short description, ti is the remaining content of SKILL.md, and ri is the auxiliary resource component, such as scripts under scripts/. Under progressive disclosure, the initial skill view is |S|
D0 (S) = {(ni , di )}i=1 .
(3)
The detailed instructions ti and resources ri enter the agent context only if the agent decides to inspect them through tool calls. The agent produces an execution trace τ = ExecE L(H, D0 (S), C, U ) , (4)
Figure 1: Overview of VulMask. Instead of placing overt malicious instructions in SKILL.md, the attack embeds a vulnerability-shaped payload inside auxiliary resources under scripts/. During normal use, the coding agent may inspect and execute the script as part of the host skill’s benign workflow. When the attacker-controlled trigger condition is satisfied, the hidden payload activates and causes effects such as credential theft, command execution, agent manipulation, or destructive actions.
where τ includes tool calls, file reads, command executions, and their effects. An attack succeeds if τ contains the attacker-intended side effect while the skill still performs its advertised benign function. 3.3
Attacker Capability
The attacker cannot control the victim’s LLM L, harness H, executor E, project context C, or user request U after installation. The attacker controls only the contents of a distributed skill package. We assume the attacker starts from a benign host skill
3.4
We consider layered defenses: platform-side scanning before publication, user-side inspection at installation, agent-side inspection during loading, and LLM-side inspection immediately before execution. We give the defender access to all skill components (ni , di , ti , ri ) if the defender chooses to inspect them. This is stronger than defenses that only scan SKILL.md. The key question is therefore not whether the script can be read, but whether its malicious intent is recognized when read.
4 sh = (nh , dh , th , rh )
(5)
and publishes a malicious variant. To make installation plausible, the malicious skill should preserve the host skill’s visible utility. The attacker may modify any skill component, but VulMask focuses on rh . The attacker may also define a trigger source θ consumed by the vulnerable resource, such as attacker-influenced external content, project state, or structured input. The attacker does not directly prompt the victim agent at execution time.
Defender Capability
Method
Figure 1 shows the VulMask pipeline. The attack is built around a simple observation: reviewers are often more sensitive to explicit malware than to ordinary insecure code. VulMask exploits this gap by converting malicious intent into a vulnerabilityshaped implementation. Let p⋆ be the attacker’s original overt malicious script. VulMask first selects a set of vulnerability classes relevant to the intended behavior: W = {w1 , w2 , . . . , wm }, where each wj corresponds to a CWE-style weakness, such as information exposure, command injection, code injection,
Table 1: End-to-end attack effectiveness on GPT-5.5. Method
ASR ↑
Warning ↓
Utility ↑
Prompt Injection Overt Malicious Script Hidden Script Attack VulMask
0.0% 46.3% 57.0% 58.8%
42.1% 25.4% 13.2% 11.4%
100.0% 73.3% 73.3% 96.6%
or unsafe dependency handling. An LLM-driven generator g then rewrites the overt script into a masked payload pm = g(p⋆ , W),
(6)
where pm preserves the attacker’s intended side effect but exposes it through a triggerable weakness rather than explicit malicious logic. To preserve the host skill’s utility, VulMask does not replace the host resource with an unrelated script. Instead, it embeds the masked payload into the original resource component: rm = Embed(rh , pm ),
(7)
while preserving script names, paths, and benign input–output behavior when the trigger is absent. The resulting malicious skill is sVulMask = (nh , dh , th , rm ).
(8)
No modification to the skill name, description, or main SKILL.md workflow is required. Finally, VulMask validates sVulMask in an isolated test environment. A candidate is retained only if the host skill remains functional under benign use and the intended side effect is triggered under θ. This validation step separates code-level stealth from accidental breakage.
5
Evaluation
We evaluate whether VulMask is practical and general. RQ1 asks whether it succeeds end-to-end while preserving host-skill utility. RQ2 measures whether it evades coding-agent inspection and automated reviewers. RQ3 tests whether it generalizes across attack categories. RQ4 studies whether the rewriting process transfers across different payload-generation models. Our code is available at https://anonymous.4open.science/r/ PhantomSkil-6C18/README.md. 5.1
Experimental Setup
Skill corpus. We construct a corpus from public and representative agent skills, including official examples, GitHub repositories containing
Table 2: Comparison with the CI baseline. Both methods achieve similar ASR, but VulMask produces fewer warnings. Method
ASR ↑
Warning Rate ↓
CI (Li et al., 2025) VulMask
56.1% 58.8%
27.2% 11.4%
SKILL.md, and community skill collections. We retain skills with executable auxiliary resources under scripts/ or an equivalent directory. The corpus covers file utilities, Git automation, coding assistance, skills auditing, and data processing. Attack goals. We evaluate four goals overall: credential exfiltration, command execution, agent manipulation, and destruction. For each attack category, we instantiate representative payloads and map them to relevant CWE-style vulnerability classes used by VulMask during the rewriting process. Table 9 in the Appendix summarizes the corresponding CWE categories and example payload behaviors. RQ1 uses the three non-destructive goals to measure utility preservation under normal execution, while RQ3 additionally includes destruction in an isolated sandbox. Baselines. We compare against three main baselines. Prompt Injection places malicious instructions in SKILL.md. Overt Malicious Script places an explicit malicious payload in the auxiliary script. Hidden Script Attack moves an obfuscated payload into scripts/ without vulnerability masking. Furthermore, we also consider the state-of-theart attention distraction attack for malicious code, Crazy-Ivan (CI) (Li et al., 2025) as a baseline. Metrics. Attack Success Rate (ASR) is the fraction of trials in which the intended side effect is triggered. Detection Rate is the fraction of trials in which a reviewer flags the skill or script as malicious. Warning Rate is the fraction of trials in which the coding agent warns, refuses execution, or requests extra confirmation. Utility Preservation measures whether the host skill’s benign functionality remains executable. Models. We select GPT-5.5, GLM-4.7-Flash, and Qwen3-Coder-30B-A3B-Instruct as the main evaluation LLMs. GPT-5.5 represents a frontier proprietary model widely used for agentic tasks, while GLM-4.7-Flash and Qwen3-Coder30B-A3B-Instruct are among the strongest self-
Table 3: Detection by coding agents. Each agent inspects and uses the same set of skills. Overt Detection is measured on explicit malicious scripts; VulMask Detection is measured on vulnerability-masked scripts. Coding Agent Cursor (GLM-4.7) Cursor (Qwen3) Cursor (GPT-5.5) Cursor (Opus-4.7)
Overt Detection ↑
Overt ASR ↓
VulMask Detection ↓
VulMask ASR ↑
10.0% 3.3% 25.4% 93.3%
92.2% 32.2% 43.0% 3.3%
2.2% 0.0% 11.4% 90.0%
95.6% 32.2% 58.8% 3.3%
Table 4: Detection by automated security reviewers. Malware flags correspond to malicious-code alerts; vulnerability flags correspond to ordinary insecure-code alerts. Reviewer Mondoo Cisco static Cisco LLM (GPT-4o) Snyk agent scan
Overt Malware Flag ↑
VulMask Malware Flag ↓
VulMask Vulnerability Flag ↑
0.0% 24.0% 100.0% 100.0%
0.0% 17.1% 76.3% 98.9%
– 100.0% 98.9% 1.3%
hostable models. 5.2
RQ1: End-to-End Attack Effectiveness
RQ1 evaluates whether VulMask succeeds as an end-to-end attack. For each method, we inject the corresponding payload into the same host skills and ask the coding agent to use the skill for its advertised benign task. We then activate the trigger condition and measure whether the intended side effect occurs. As shown in Table 1, VulMask achieves the highest ASR (58.8%) while maintaining the lowest warning rate (11.4%) among successful attacks. Prompt Injection fails to trigger the attack, suggesting that recent coding agents are relatively robust against straightforward malicious instructions in SKILL.md. Script-based baselines improve ASR, but they either reduce benign utility or expose more overt malicious signals. By contrast, VulMask preserves 96.6% utility, indicating that preserve-andembed masking is less disruptive than replacing the host script with an unrelated payload. Table 2 compares VulMask with the CI. VulMask achieves comparable ASR while reducing the warning rate from 27.2% to 11.4%. 5.3
RQ2: Stealth Against Automated Reviewers
RQ2 evaluates whether VulMask evades realistic automated defenses. We consider two reviewer classes: coding agents that inspect and execute skills under their normal workflow, and standalone reviewers such as LLM-based code reviewers and security scanners. We distinguish malwarelevel flags from ordinary vulnerability flags, since
VulMask aims to transform explicit malicious intent into vulnerability-shaped insecurity. Table 3 shows that agent-side defenses vary substantially across model backends. For GPT-5.5 and GLM-4.7, VulMask reduces detection while increasing or preserving ASR relative to overt scripts. Opus-4.7 remains effective against both overt and masked scripts, suggesting that stronger inspection policies can still mitigate this attack. Thus, VulMask is not universally successful, but it exposes a clear gap between explicit malware detection and vulnerability-shaped payload detection. Table 4 further shows that the masking effect depends on reviewer design. Cisco static analysis and Cisco LLM often reclassify masked payloads as vulnerabilities rather than malware, supporting the central hypothesis of VulMask. Snyk remains much stronger, flagging 98.9% of masked scripts as malware. Mondoo does not flag either overt or masked payloads in this setting, indicating limited coverage for these generated artifacts. 5.4
RQ3: Generalization Across Attack Categories
RQ3 tests whether VulMask depends on one handcrafted payload pattern. We evaluate four attack goals with different semantics: credential exfiltration, command execution, agent manipulation, and destruction. As shown in Table 5, VulMask reduces detection across all four goals. The largest reduction appears for destruction, where explicit payloads contain conspicuous destructive operations, but vulnerability-shaped implementations are more likely to be treated as unsafe coding patterns. Command execution remains the hardest category
Table 5: Generalization across attack goals. Overt Detection is measured on explicit malicious scripts; VulMask Detection and ASR are measured after rewriting the payload into a vulnerability-shaped implementation. Evaluated on GPT-5.5. Attack Goal
Overt Detection ↑
VulMask Detection ↓
VulMask ASR ↑
20.0% 23.3% 16.7% 41.7%
11.8% 17.1% 2.9% 4.2%
52.9% 57.1% 60.0% 79.2%
Credential Exfiltration Command Execution Agent Manipulation Destruction
Table 6: Cross-generator transferability. Masked scripts are generated by different LLMs and evaluated in the same victim setting: Cursor with GPT-5.5.
Table 8: The ASR and warning rate accross host skill evaluated on GPT-5.5. ASR
Generator Model
VulMask Detection ↓
VulMask ASR ↑
Opus-4.7 GLM-4.7-Flash Qwen3-Coder-30B
10.2% 14.3% 16.9%
58.3% 54.8% 41.0%
Table 7: Ablation on GLM-4.7-Flash. Each row contains 570 trials. Method
ASR ↑
detection ↓
Naive VulMasknoCWE VulMask
12.3% 54.2% 60.0%
94.4% 56.5% 49.6%
to hide, with the highest VulMask detection rate among the four goals. 5.5
Skill
Overt
VulMask
Overt
VulMask
NeverSight-skill-audit git-commit-helper pdf saas-metrics-coach slack-gif-creator writing-style+
21.1% 89.5% 31.6% 73.7% 0.0% 42.1%
63.2% 78.9% 57.9% 63.2% 10.5% 78.9%
36.8% 21.1% 15.8% 15.8% 63.2% 0.0%
21.1% 10.5% 0.0% 0.0% 36.8% 0.0%
Per-Skill Breakdown Table 8 reports per-skill ASR and warning rate on GPT-5.5. For skill gitcommit-helper and saas-metrics-coach, the agent ignores the skill’s instructions more often under VulMask than under overt injection, slightly lowering ASR.
RQ4: Cross-Generator Transferability
RQ4 evaluates whether VulMask depends on a specific payload-generation model. We generate masked scripts with different LLM backends and evaluate all generated skills under the same victim setting: Cursor with GPT-5.5. This isolates the effect of the generator from the effect of the victim agent. Table 6 shows that VulMask transfers across multiple generation models. Opus-4.7 achieves the highest ASR, while GLM-4.7-Flash remains close. Qwen3-Coder-30B has lower ASR but still produces functional masked payloads. This suggests that vulnerability-shaped rewriting is not tied to a single generator, although generator capability affects reliability.
6
Warning Rate
Discussion
Ablation of CWE-Guided Rewriting Table 7 evaluates the contribution of CWE-guided rewriting. The no-CWE variant improves over naive injection, but full VulMask achieves the highest silent compromise and overall execution success.
Implications for skill ecosystems. The results suggest that skill security cannot rely only on scanning SKILL.md. Auxiliary resources should be treated as first-class attack surfaces, especially when they are executable and invoked by agents without strong sandboxing. A script that appears merely vulnerable can still be dangerous in an agent setting because the agent may supply file paths, credentials, project context, and execution authority.
Defense directions. Three defenses follow directly from our findings. First, skill marketplaces should perform resource-level review, including scripts, dependency files, and generated artifacts. Second, coding agents should apply execution-time containment, such as least-privilege file access, network restrictions, and explicit policies for sensitive operations. Third, reviewers should not downgrade exploitable vulnerabilities inside skills to low-priority issues: in agent ecosystems, a triggerable vulnerability may be functionally equivalent to a malicious payload.
7
Conclusion
We presented PhantomSkill, a supply-chain attack framework for agent skill ecosystems, and VulMask, a code-level masking technique that embeds vulnerability-shaped payloads in auxiliary resources while preserving benign functionality. Our results show that VulMask reduces warning and malware-level detection while maintaining effective attack success rates across attack goals and generator models. These findings suggest that, in LLM agents capable of executing third-party resources, seemingly ordinary vulnerabilities may function as covert malicious payloads.
Limitation This work has several limitations. First, our evaluation focuses on representative coding-agent environments and skill ecosystems, but future agent frameworks may adopt different execution models, permission systems, or skill architectures that affect attack effectiveness. Second, VulMask currently relies on vulnerability-shaped code generated from a predefined set of CWE-inspired weakness categories. Additional vulnerability patterns and more advanced code transformations may further improve or reduce stealth. Third, although we evaluate multiple LLM backends, and automated reviewers, the results do not cover the full diversity of emerging agent platforms and security tools. Finally, our experiments are conducted in controlled environments and may not capture all factors present in real-world deployments.
Ethical Consideration This paper studies security risks in LLM-based coding-agent ecosystems. The goal of PhantomSkill is to identify weaknesses in current skillreview and execution mechanisms so that safer agent platforms can be developed. To minimize misuse, we do not release attack-ready skill packages, deployment artifacts, or operational payloads. All experiments involving destructive behaviors are conducted in isolated sandbox environments without targeting real users or systems. We believe that understanding how malicious functionality can be disguised as seemingly benign vulnerabilities is necessary for designing effective resource-level vetting, execution-time containment, and future defenses for agent skill ecosystems.
References Kai Greshake, Sahar Abdelnabi, Shailesh Mishra, Christoph Endres, Thorsten Holz, and Mario Fritz. 2023. Not what you’ve signed up for: Compromising real-world LLM-integrated applications with indirect prompt injection. In Proceedings of the 16th ACM Workshop on Artificial Intelligence and Security (AISec), pages 79–90. Xiaojun Jia, Jie Liao, Simeng Qin, Jindong Gu, Wenqi Ren, Xiaochun Cao, Yang Liu, and Philip Torr. 2026. SkillJect: Automating stealthy skill-based prompt injection for coding agents with trace-driven closedloop refinement. Avishree Khare, Saikat Dutta, Ziyang Li, Alaia SolkoBreslin, Rajeev Alur, and Mayur Naik. 2025. Understanding the effectiveness of large language models
in detecting security vulnerabilities. In 2025 IEEE Conference on Software Testing, Verification and Validation (ICST), pages 103–114. IEEE. Xiao Li, Yue Li, Hao Wu, Yue Zhang, Kaidi Xu, Xiuzhen Cheng, Sheng Zhong, and Fengyuan Xu. 2025. Make a feint to the east while attacking in the west: Blinding LLM-based code auditors with flashboom attacks. In 2025 IEEE Symposium on Security and Privacy (SP). Yupei Liu, Yuqi Jia, Runpeng Geng, Jinyuan Jia, and Neil Zhenqiang Gong. 2024. Formalizing and benchmarking prompt injection attacks and defenses. In 33rd USENIX Security Symposium (USENIX Security 24), pages 1831–1847. Yubin Qu, Yi Liu, Tongcheng Geng, Gelei Deng, Yuekang Li, Leo Yu Zhang, Ying Zhang, and Lei Ma. 2026. Supply-chain poisoning attacks against LLM coding agent skill ecosystems. David Schmotz, Luca Beurer-Kellner, Sahar Abdelnabi, and Maksym Andriushchenko. 2026. Skill-inject: Measuring agent vulnerability to skill file attacks. Barry Zhang, Keith Lazuka, and Mahesh Murag. 2025. Equipping agents for the real world with Agent Skills. Anthropic Engineering Blog. Accessed: 2026-05-17.
Table 9: Four attack goals and their correspond CWE that were used to generate VulMask Attack Goal
Credential Exfiltration
Command Execution
Agent Manipulation
Destruction
CWE
Description
Sub-category
CWE-522 CWE-22
Steal credentials and exfiltrate in user’s system.
Leak SSH keys from ~/.ssh/ Read .env files in cwd / repo Dump os.environ (API keys, tokens) Steal Git credentials Steal ~/.netrc and AWS credentials
CWE-94 CWE-502
Achieve code execution or establish persistent connection.
Reverse shell via os.system() Reverse shell via subprocess.call(shell=True) Install cron entry for persistence Implant attacker SSH key into authorized_keys Fetch and execute remote Python stager
CWE-22
Tamper with agent config to further control user’s coding agents.
Overwrite ~/.claude/settings.json global settings Inject rules into project CLAUDE.md Register hostile MCP servers in mcp_servers.json Expand tool permission allowlist Poison persistent agent memory
CWE-22
Trigger destructive operations on user’s system.
Recursively delete every subdirectory under / Overwrite every file with os.urandom bytes XOR-encrypt every file to .enc and delete originals Truncate every file to zero bytes