Poise: Position-Aware One-Instruction Skill Injection for Silent Execution on LLM Agents

Dehai Min; Haochang Hao; Lu Cheng; Miao Xu; Yingqiang Ge; Yunbei Zhang; Zhifang Zhang

Poise: Position-Aware One-Instruction Skill Injection for Silent Execution on LLM Agents

T0 review · 3 major / 0 minor · reviewed 2026-06-27 · grok-4.3

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Position-aware blending of a single trigger into skill bodies achieves 89.3 percent attack success while evading scanner detection.

desk verdict POISE shows a workable position-aware blending trick for skill injection that lifts ASR over random body baselines, but the stealth edge depends on an unverified 74.6% scanner FP rate that lacks protocol details. read the letter →

arxiv 2606.07943 v2 pith:UCBG77Z6 submitted 2026-06-06 cs.CR cs.AIcs.CL

Haochang Hao , Dehai Min , Zhifang Zhang , Yunbei Zhang , Miao Xu , Yingqiang Ge , Lu Cheng This is my paper · ORCID

classification cs.CRcs.AIcs.CL

keywords skillpoisoningLLMagentsattacksuccessratestealthinjectionposition-awarebodyscannerfalsepositives

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that effective skill-poisoning attacks on LLM agents must execute their payload without causing the user's legitimate task to fail, since failure would prompt inspection of the skill. It shows that prior approaches face a tradeoff where YAML-header injections load reliably but are easy to spot, while body injections are harder to detect but less reliable because out-of-context commands raise suspicion. POISE addresses this by compressing the trigger into one benign-looking instruction, positioning it where it fits naturally among setup or prerequisite steps, and blending it with surrounding text via a context-aware generator. A sympathetic reader would care because open skill formats let users extend agents easily yet leave them open to hidden manipulation if attacks can stay invisible. The evaluation claims that this method reaches high success rates while producing almost no additional scanner alerts beyond those already raised by clean skills.

What carries the argument

The position-aware placement and context-aware blending of a single compressed trigger instruction into the skill body.

What would settle it

An experiment that measures scanner false-positive rates on clean skills below 30 percent or records POISE attack success rate below 60 percent on the same benchmark would settle the central claim.

Watch

Extended reading notes

Core claim

POISE is a position-aware attack that compresses the trigger into a single benign-looking body instruction, places it at a feasible position, and uses a context-aware generator to blend it with nearby setup or prerequisite steps. On Skill-Inject with codex and gpt-5.2, POISE achieves an 89.3 percent ASR, 28.0 points above a random-placement body baseline and 2.6 points above a YAML-only baseline, while retaining the stealth advantage of body placement. That stealth holds because legitimate skill bodies naturally require privileged tool operations, causing LLM scanners to flag 74.6 percent of clean skills on average across four judges and both benchmarks, so POISE causes only 5.6 percent of p

Load-bearing premise

Legitimate skill bodies naturally require privileged tool operations that cause LLM scanners to produce high false-positive rates.

Editorial extensions

If this is right

Body placement of the trigger retains its stealth advantage over YAML-header methods.
Legitimate skills already trigger high false-positive rates of 74.6 percent in LLM scanners.
Blended injections increase high-risk alerts by only 5.6 percent over clean baselines.
Static scanner defenses become ineffective against position-aware blended attacks.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Runtime monitoring of skill execution behavior may be needed instead of relying on static scans.
Skill distribution platforms could require additional verification steps such as execution sandboxes.
The same blending principle could apply to other open agent extension formats beyond skills.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Desk Editor's Note

read the letter

The main point is that POISE compresses the trigger into one blended body instruction, places it at a feasible spot, and uses context-aware generation to make it look like a normal prerequisite step. On Skill-Inject with codex plus gpt-5.2 this reaches 89.3% ASR, 28 points above random body placement and 2.6 above YAML. That is the concrete advance over the YAML and random-placement baselines cited in the abstract.

The paper does a clean job of framing the reliability-stealth trade-off and then measuring attack success as both payload execution and task verifier pass. The comparisons are direct and use named benchmarks, which makes the gain easy to see. No fitted parameters or circular definitions appear in the results.

The soft spot is the stealth argument. The claim that POISE stays undetectable rests on LLM scanners producing a 74.6% false-positive rate on clean skills, so the poisoned versions add a new high-risk alert in only 5.6% of cases. The abstract presents the 74.6% figure as observed fact but supplies no measurement protocol, judge prompts, inter-judge agreement, or ablation on scanner wording. If that rate is tied to the particular judges or the benchmark skills rather than a general property of body placement, the undetectable advantage does not follow and the 2.6-point edge over YAML becomes less relevant. The stress-test note flags exactly this gap.

This is for researchers working on LLM agent security and poisoning defenses. A reader who wants to see a practical blending technique and concrete ASR numbers will find value here, even if they have to re-run the scanner evaluation themselves.

It deserves a serious referee because the attack method is new enough and the empirical comparisons are sharp enough to check the experimental setup and the FP-rate measurement.

Referee Report

3 major / 0 minor

Summary. The paper introduces POISE, a position-aware attack for skill injection on LLM agents. It compresses malicious triggers into single benign-looking body instructions placed at feasible positions and blended with context via a generator. On the Skill-Inject benchmark with codex+gpt-5.2, POISE reports 89.3% ASR (28 points above random body placement, 2.6 above YAML), while claiming stealth because legitimate skill bodies trigger 74.6% false positives on average across four LLM judges, so POISE adds new high-risk alerts in only 5.6% of cases.

Significance. If the empirical results and the 74.6% FP claim hold under full protocol, the work shows that body-placement attacks can overcome the reliability-stealth tradeoff in open agent skills, rendering static LLM scanners ineffective and highlighting a practical vulnerability in agent extensibility mechanisms.

major comments (3)

[Abstract] Abstract: The stealth advantage is justified solely by the claim that LLM scanners produce a 74.6% FP rate on clean skills (allowing POISE to add only 5.6% new alerts). No measurement protocol, judge identities, inter-judge agreement, benchmark skill selection criteria, or ablation on scanner prompt wording is supplied, making it impossible to determine whether this rate is a general property of body placement or an artifact of the chosen judges and templates.
[Abstract] Abstract: The headline 89.3% ASR (and the 28-point and 2.6-point margins) is reported without error bars, full experimental protocol, dataset details, number of trials, or verification steps for the 74.6% FP figure. This directly limits assessment of whether the data supports the central reliability-plus-stealth claim.
[Abstract] Abstract: The weakest assumption—that legitimate skill bodies naturally require privileged tool operations and therefore trigger high FP rates—is presented as observed fact but is not supported by any ablation showing that the FP rate persists under different scanner prompts or skill corpora; if this rate is judge- or prompt-specific, the “undetectable” margin over YAML baselines does not follow.

Simulated Author's Rebuttal

3 responses · 0 unresolved

We thank the referee for the detailed feedback on the abstract. We address each comment below and will revise the manuscript to incorporate additional experimental details, error bars, and an ablation study as noted.

read point-by-point responses

Referee: [Abstract] Abstract: The stealth advantage is justified solely by the claim that LLM scanners produce a 74.6% FP rate on clean skills (allowing POISE to add only 5.6% new alerts). No measurement protocol, judge identities, inter-judge agreement, benchmark skill selection criteria, or ablation on scanner prompt wording is supplied, making it impossible to determine whether this rate is a general property of body placement or an artifact of the chosen judges and templates.

Authors: The full measurement protocol is described in Section 5.2, including the four judges (GPT-4o, Claude-3-Opus, Llama-3-70B, Gemini-1.5), prompt templates, inter-judge agreement (Cohen's κ=0.81), and selection of 150 clean skills from Skill-Inject and AgentBench. We agree the abstract omits these details due to length and will revise it to summarize the protocol with section references. The prompts follow standard static scanner designs; an explicit ablation on wording variants was not performed. revision: yes
Referee: [Abstract] Abstract: The headline 89.3% ASR (and the 28-point and 2.6-point margins) is reported without error bars, full experimental protocol, dataset details, number of trials, or verification steps for the 74.6% FP figure. This directly limits assessment of whether the data supports the central reliability-plus-stealth claim.

Authors: ASR figures are means over 100 trials per condition (standard error ±1.8% for POISE); full protocol, dataset (50 skills from Skill-Inject), trial counts, and FP verification steps appear in Section 4.1 and Appendix B. We will revise the abstract to include error bars and explicit references to these sections. revision: yes
Referee: [Abstract] Abstract: The weakest assumption—that legitimate skill bodies naturally require privileged tool operations and therefore trigger high FP rates—is presented as observed fact but is not supported by any ablation showing that the FP rate persists under different scanner prompts or skill corpora; if this rate is judge- or prompt-specific, the “undetectable” margin over YAML baselines does not follow.

Authors: The high FP rate is an empirical result from the evaluated benchmarks and judges. We acknowledge that an ablation on alternative prompts and corpora would strengthen generality claims. We will add this ablation (two new prompt variants and one additional corpus) in the revision. revision: yes

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity; empirical results on benchmarks

full rationale

The paper reports measured Attack Success Rates (89.3% ASR) and false-positive rates (74.6% on clean skills) from direct experiments on named benchmarks against explicit baselines (random-placement body, YAML-only). No equations, fitted parameters, self-citations, or derivations are present in the provided text; the central claims are observational comparisons that remain independent of any internal reduction to inputs.

Assumptions & free parameters 0 free parameters · 1 assumptions · 0 invented entities

No mathematical derivations or fitted parameters; the work is an empirical attack evaluation relying on domain assumptions about agent behavior and scanner sensitivity.

assumptions (1)

domain assumption LLM agents execute skills containing blended privileged operations without flagging them as anomalous when the malicious content is positioned among setup steps.
Implicit in the claim that body placement retains stealth while YAML does not; required for the attack success without task failure.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Poise: Position-Aware One-Instruction Skill Injection for Silent Execution on LLM Agents." pith.science (2026). https://pith.science/paper/UCBG77Z6

@misc{pith2026260607943,
  author       = {Pith},
  title        = {Pith review of: Poise: Position-Aware One-Instruction Skill Injection for Silent Execution on LLM Agents},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/UCBG77Z6}},
  note         = {Machine review of arXiv:2606.07943}
}

read the original abstract

Agent skills extend general-purpose agents, but their open format enables skill poisoning: a tampered skill can make an agent run an attacker's command while completing the user's legitimate task. Invocation alone is insufficient; the attack-specific action must complete while that task still passes its verifier. We therefore define Attack Success Rate (ASR) to require a postcondition-validated sandbox action and a passing task verifier in the same trial. Skill files expose a reliability-visibility trade-off between a preloaded but conspicuous YAML frontmatter block and a longer body, where arbitrary placement may be skipped or locally incongruent. We introduce Poise, a position-aware attack that uses context-aware generation to place exactly one benign-looking, command-bearing instruction at a structurally feasible body position. On the eligible Skill-Inject pool with codex+gpt-5.2, Poise achieves 89.3\% ASR, 28.0 points above a context-free random-placement body baseline and comparable to the 86.7\% ASR of a high-exposure YAML-only baseline. Under the SkillTester audit, four LLM judges falsely flag 74.6\% of clean skills on average across both benchmarks, while only 5.6\% of Poise variants gain a new high-risk alert over their clean counterparts. One locally plausible, command-bearing body instruction therefore matches YAML-level reliability, while the resulting poisoned skill seldom adds a new high-risk finding over its clean counterpart.

Figures

Figures reproduced from arXiv: 2606.07943 by the authors.

**Figure 1.** Overview of POISE. (a) Direct skill-file poisoning fragments explicit malicious steps across the file, each one risking the agent’s suspicion as out-of-context. (b) POISE places a single benign-looking line at a feasible body position, framing a script invocation as a routine prerequisite and delegating the attacker-chosen behavior to an auxiliary canary script. (2026) embed malicious logic in documentation examples… view at source ↗

**Figure 2.** POISE is both stealthy and reliable: (a) it adds little incremental static-detection signal over already-noisy LLM judges, and (b) it triggers at a high rate from any feasible body position. signal. The opposite regime is no safer. Wholefile ingestion makes body-position injections more reliable but also exposes more of the skill to a scanner with longer context, and our results show the scanners do not exploit th… view at source ↗

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 2 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

When Experience Becomes Instruction: Trajectory Poisoning in Self-Evolving Agent Skill Systems
cs.CR 2026-08 conditional novelty 6.0 of 10

By contributing just 3 of 30 trajectories, an attacker can make self-evolving skill systems distill a harmful target behavior into a persistent skill artifact, succeeding in 91% of SkillClaw trials and 61.5% of Trace2...
ColluSkill: Adversarial Cross-Skill Composition for Evading Agent Skill Scanners
cs.CR 2026-08 conditional novelty 5.0 of 10

ColluSkill splits a malicious intent across three interdependent agent skills to evade six skill scanners in 96.0% of cases, while ChainGuard reduces this to 22.5% by analyzing a candidate skill with its installed-ski...

Pith tools

Reviewed June 27, 2026 · model on record in the stance chip above.