SkillJack: Persistent Skill Backdoors in Self-Evolving Agents
The attack turns poisoned agent experiences into reusable skills that can outlive the records that created them.
The paper says SkillJack targets the step where self-evolving agents convert past interactions into durable skills, rather than relying on poisoned context being retrieved later. In tests on SkillX and Anything2Skill, safety detection fell sharply after poisoned trajectories were extracted into skills, while the implanted behaviors still worked. The authors report attack success rates of 56.2% and 89.2% on the two systems, and say 80.0% of skill-mediated attacks persisted after the original poisoned records were deleted. Some extracted skills also activated unintentionally on benign queries. HF Daily Papers' note
The paper says SkillJack targets the step where self-evolving agents convert past interactions into durable skills, rather than relying on poisoned context being retrieved later. In tests on SkillX and Anything2Skill, safety detection fell sharply after poisoned trajectories were extracted into skills, while the implanted behaviors still worked. The authors report attack success rates of 56.2% and 89.2% on the two systems, and say 80.0% of skill-mediated attacks persisted after the original poisoned records were deleted. Some extracted skills also activated unintentionally on benign queries. HF Daily Papers' note
score 5