SkillTrojan: Backdoor Attacks on Skill-Based Agent Systems

Skill-based agent systems tackle complex tasks by composing reusable skills, improving modularity and scalability while introducing a largely unexamined security attack surface. We propose \textbf{SkillTrojan}, a backdoor attack that targets skill implementations rather than model parameters or training data. SkillTrojan embeds malicious logic inside otherwise plausible skills and leverages standard skill composition to reconstruct and execute an attacker-specified payload. The attack partitions an encrypted payload across multiple benign-looking skill invocations and activates only under a predefined trigger. SkillTrojan also supports automated synthesis of backdoored skills from arbitrary skill templates, enabling scalable propagation across skill-based agent ecosystems. To enable systematic evaluation, we release a dataset of 3,000+ curated backdoored skills spanning diverse skill patterns and trigger–payload configurations. We instantiate SkillTrojan in a representative code-based agent setting and evaluate both clean-task utility and attack success rate. Our results show that skill-level backdoors can be highly effective with minimal degradation of benign behavior, exposing a critical blind spot in current skill-based agent architectures and motivating defenses that explicitly reason about skill composition and execution. Concretely, on EHR SQL, SkillTrojan attains up to \textbf{97.2\%} ASR while maintaining \textbf{89.3\%} clean ACC on GPT-5.2-1211-Global. Code is available at \url{https://github.com/Yunhao-Feng/SkillTrojan}.

Skill-based AI agents solve tasks by reusing small modules called skills, such as tools for reading files, querying databases, or running code. These skills make agents more useful, but they can also become a hidden security risk if people install skills from third parties without carefully checking what they do. In this paper, we show that an attacker can hide malicious behavior inside otherwise normal-looking skills. The agent still appears to complete the user’s task correctly, but when a special trigger is present, the hidden parts of the malicious code can be pieced together and executed in the background. We build a benchmark of backdoored skills and test the attack in code-based agent settings, showing that it can succeed often while causing little change in normal task performance. Our findings suggest that future AI agents should not only check final answers, but also audit the skills they use, how those skills are composed, and what side effects occur during execution.