Source note
Supply-Chain Poisoning Attacks Against LLM Coding Agent Skill Ecosystems
Summary
This paper studies supply-chain attacks against LLM coding agents that load third-party skills from open marketplaces. It introduces a poisoning method that hides malicious code inside skill documentation so the agent copies and executes it during normal work.
Problem
- Coding agents trust skill files that contain instructions, code examples, and config templates, and these agents often have file, shell, and network access on the host.
- Prior work looked at tool-selection manipulation and text-output poisoning, but not whether a poisoned skill can make the agent execute malicious actions on the machine itself.
- This matters because one malicious skill can lead to data exfiltration, privilege escalation, build/config tampering, or other host-level compromise without an explicit malicious user prompt.
Approach
- The paper proposes Document-Driven Implicit Payload Execution (DDIPE): hide the payload inside benign-looking code examples or configuration templates in a skill’s documentation.
- When the agent solves a normal coding or setup task, it treats those examples as trusted reference code, reproduces the poisoned pattern, and then executes its own generated output.
- The attack uses two main embedding paths: code example poisoning and configuration template poisoning.
- To scale testing, the authors build an LLM-driven seed-mutation-validation pipeline that expands 81 seed skills into adversarial variants across 15 MITRE ATT&CK categories.
- The attack also uses camouflage such as compliance-style wording, internal-service-looking endpoints, and silent exception handling to reduce detection.
Results
- The evaluation covers 1,070 adversarial skills, 4 agent frameworks (Claude Code, OpenHands, Codex, Gemini CLI), and 5 models (Claude Sonnet 4.6, GLM-4.7, MiniMax-M2.5, GPT-5.4, Gemini 2.5 Pro).
- DDIPE reaches 11.6% to 33.5% bypass rates across the tested configurations.
- An explicit instruction injection baseline reaches 0% under the strongest defenses reported by the paper.
- Static analysis blocks 90.7% of attacks, but 2.5% still evade both static detection and model alignment.
- Removing architectural protection increases execution rate by up to 11.3× for one model, while another model changes little, which shows model-dependent interaction between alignment and framework defenses.
- Responsible disclosure produced 4 confirmed vulnerabilities and 2 deployed fixes in production frameworks.