Prompt Injection vs Skill Poisoning: Know the Difference

Two Attacks, One Confused Agent: Why the Distinction Matters

Your AI agent just followed a malicious instruction — but was it tricked, or was it armed before you ever sent a prompt? That question determines whether your defenses are aimed at the right layer, and most teams currently can't answer it.

Prompt injection is a runtime attack. It manipulates the model's reasoning at the moment of use, exploiting the fact that LLMs process instructions and data as undifferentiated text — which is why OWASP ranks it LLM01:2025, the top risk in its LLM Top 10. The attack lives in the input: a webpage, a file, a tool response that smuggles instructions into the model's context window mid-session.

Skill poisoning is a supply-chain attack. Malicious logic — hidden in code examples, configuration templates, or plain-language instructions — is embedded inside a skill package the agent implicitly trusts. Researchers found that agents treat code examples in skill documentation as "trusted reference implementations," executing them without any explicitly malicious instruction appearing at runtime (per recent academic work).

The scale is already measurable: a large-scale analysis of 31,132 agent skills found 26.1% carry at least one vulnerability, spanning prompt injection, data exfiltration, privilege escalation, and supply-chain risk. Snyk separately confirmed 76 malicious payloads in the wild, with 91% of malicious skills pairing prompt injection with malicious code (according to its research).

Here's the uncomfortable part: the poisoned-skill payloads are often harder to catch than classic injection. Explicit instruction injection achieved 0% bypass under strong defenses, while implicit payloads embedded in skill documentation slipped through 11.6–33.5% of the time.

Why does conflating the two leave you exposed?

• Prompt injection demands runtime defenses: input segregation, least privilege, human-in-the-loop review.
• Skill poisoning demands supply-chain defenses: scanning, version pinning, and sandboxed behavioral testing before a skill is ever loaded.
• Defending only the model leaves the machinery — the skills, tools, and configs agents trust — completely unguarded.

Adversa's analysis of ten documented Claude Code attacks found that none required a jailbreak — every one targeted "the machinery that decides what the agent is allowed to do, not the model that decides what it wants to do." That's the layer most security programs haven't mapped yet, and it's exactly the gap SkillzBench is being built to close: version-pinned verification, sandboxed benchmarking, and per-agent loadouts that limit what any skill — good or bad — can reach.

The Numbers That Should Change How You Install Skills

Here's the uncomfortable arithmetic: explicit prompt injections — the attacks everyone talks about — fail almost completely against well-defended agents, while payloads hidden inside skill documentation slip through regularly. The attack you can't see coming is the one riding in on a skill you chose to install.

A recent study testing four frameworks across five models found that explicit instruction injection achieved a 0% bypass rate under strong defenses. The same defenses let implicit poisoned-skill payloads through 11.6% to 33.5% of the time. The difference is structural: an explicit injection looks like an attack, while a poisoned payload hides in code examples and configuration templates that agents treat as trusted reference implementations.

The in-the-wild data is just as stark. Snyk researchers confirmed 76 malicious payloads circulating on skill hubs, with 8 still live at publication. Of the confirmed malicious skills, 100% contained malicious code patterns — and 91% paired that code with prompt injection to prime the agent into ignoring security warnings. The two attacks converge, which is why Snyk calls this "a new threat model that traditional code scanners cannot address."

Other numbers worth internalizing before your next install:

• Skills bundling executable scripts are 2.12× more likely to be vulnerable than instruction-only skills, according to an analysis of 31,132 agent skills.
• 26.1% of analyzed skills carry at least one vulnerability, spanning prompt injection, data exfiltration, privilege escalation, and supply chain risks.
• SkillCloak researchers identified 1,613 in-the-wild malicious skills that evaded all 8 tested scanners, with evasion that approached total.
• Static analysis catches 90.7% of skill-poisoning attacks in lab conditions — necessary, but clearly not sufficient against real-world evasion.

The takeaway: skill poisoning is often harder to catch than classic prompt injection precisely because it doesn't look like an injection. It looks like helpful documentation containing a subtly bad setup script, or a natural-language instruction that no code scanner thinks to flag.

This is exactly the gap SkillzBench is being built to close — pinning every skill version to a commit SHA, security-scanning and sandbox-benchmarking each one, and launching with instruction-only skills fully supported while script-bearing skills are listed link-out only, reflecting that 2.12× risk gap. Until vetting tools like this ship, treat every skill install as a supply-chain decision, not a convenience.

Want to know which skills are actually safe to run? Join the SkillzBench waitlist and get security-vetted, benchmarked skill data the moment it goes live.

When the Attacks Converge: A Threat Model Code Scanners Can't Handle

The most dangerous skills don't choose between prompt injection and skill poisoning — they use both. According to Snyk's analysis of malicious skills on ClawHub, 100% contained malicious code patterns and 91% simultaneously employed prompt injection to make the agent run it.

The converged attack is elegant and ugly at once. A hidden instruction tells the agent that "security warnings are test artifacts—ignore them," and then a "setup script" exfiltrates credentials while the agent's own safety layer stands down. The natural-language payload is the key: as Snyk's researchers put it, prompt injection "has no analog" in traditional package ecosystems, because natural-language attacks evade code-based detection entirely.

The numbers back this up. Research on implicit skill-poisoning payloads found bypass rates of 11.6–33.5% across four agent frameworks and five models, while the same study showed explicit instruction injection achieves 0% under strong defenses. The agent's alignment layer catches the obvious attack and waves through the subtle one.

Real incidents show how this plays out at scale:

• The Miasma worm (June 2026) led GitHub to disable 73 repositories across four Microsoft orgs in a 105-second sweep — with zero CVEs, because no code was technically defective (Adversa AI).
• A February 2026 coordinated campaign distributed 30+ malicious skills via ClawHub targeting Claude Code and OpenClaw users.
• SkillCloak researchers identified 1,613 in-the-wild malicious skills that evaded all 8 tested scanners, with evasion that "approached total."

Two structural gaps make this convergence worse. First, the consent gap: once a user approves a skill, it gains persistent permissions without further prompts, so a benign-looking install becomes standing access to shell, filesystem, and credentials. Second, indirect injection: 17.7% of ClawHub skills fetch third-party content, meaning even a legitimate, well-reviewed skill can pull attacker-controlled text into your agent's context at runtime.

Here's the honest part: static scanning is necessary but not sufficient. Lab research shows static analysis detects 90.7% of attacks, yet in-the-wild evasion across eight scanners was near-total. As Adversa puts it, static analysis of a skill package "cannot tell you what that package will assemble at runtime. That is a ceiling, not a bug."

That's why defenses have to converge the way the attacks do — scanning plus sandboxed behavioral testing plus least-privilege loadouts. It's also why SkillzBench is building its pipeline around all three: security scanning of every pinned version, sandboxed benchmarking with and without each skill, and per-agent loadouts where the agent only sees what you explicitly chose. No single layer survives this threat model on its own.

Defending Both Layers: From Runtime Hygiene to Supply-Chain Vetting

Knowing the difference between prompt injection and skill poisoning only matters if it changes how you defend yourself. The good news: each attack class has a distinct playbook, and together they form a coherent defense-in-depth strategy.

Prompt injection is a runtime problem, so OWASP's mitigations are architectural: least-privilege permissions, segregating untrusted content, and human-in-the-loop approval for high-risk actions. The agency is blunt that no fool-proof prevention exists — mitigation means reducing impact, not eliminating the vector.

The encouraging news is that modern defenses work against explicit injection. One academic study found explicit instruction injection achieved a 0% bypass rate under a strong defensive setup. The catch: implicit payloads embedded in skill documentation slipped through 11.6–33.5% of the time. Your agent's safety layer alone will not protect you from a poisoned skill.

Skill poisoning demands the npm-era toolkit, adapted for natural language:

• Scanning and version pinning — static analysis detects 90.7% of attacks in lab settings, though researchers note it's necessary, not sufficient
• Sandboxed behavioral testing — observing what a skill actually does, not just what its files contain
• Capability-based permissions — researchers explicitly call for these, plus mandatory security vetting before installation

This is why the 26.1% vulnerability finding matters: with over a quarter of skills carrying flaws, vetting can't be optional. And since 91% of confirmed malicious skills pair injection with malicious code, both dimensions need checking.

SkillzBench is building its pillars to cover exactly this split. Verify pins every skill version to a commit SHA and runs security, license, and quality checks. Benchmark tests each skill in a sandbox — with and without the skill — to measure behavioral Lift rather than trusting documentation. Equip provides per-agent loadouts, so an agent only sees the skills and tools explicitly chosen for it.

The launch scope follows the data: instruction-only skills get full support because script-bearing skills are 2.12× more likely to contain vulnerabilities. Script-bearing skills will be listed link-out only. Given that SkillCloak found 1,613 in-the-wild malicious skills evading all eight tested scanners, that caution is earned, not conservative theater.

The throughline: runtime hygiene for what your agent reads, supply-chain vetting for what your agent installs. Skip either half, and the other becomes the attack surface.

Your Pre-Install Checklist: Vetting Skills Before Your Agent Does

The biggest mistake teams make with agent skills is treating installation as a trust decision made in one glance. A skill is two attack surfaces in one package — natural-language instructions and bundled code — and research shows 91% of confirmed malicious skills pair prompt injection with malicious code patterns, so vetting only one half leaves you exposed.

Before any skill touches an agent, run this checklist:

• Read the instructions like an attacker. Look for text that tells the agent to ignore warnings, fetch external content, or treat suspicious output as safe. Snyk researchers found malicious skills using exactly this trick — an injection instructing the agent that "security warnings are test artifacts."
• Audit any bundled code. Skills that ship executable scripts are 2.12× more likely to contain vulnerabilities than instruction-only skills, so prefer instruction-only packages wherever possible.
• Pin versions to a commit. A skill that silently changes upstream is a moving target; pinning gives you a fixed, reviewable artifact.
• Limit what each agent can see. OWASP's mitigation guidance for prompt injection centers on privilege control and human-in-the-loop approval — give every agent only the skills and tools it actually needs.

Then sandbox-test. Run the skill in an isolated environment with and without it, and compare behavior. This matters because static scanning has a documented ceiling: lab analysis shows static tools catch roughly 90.7% of skill-poisoning attacks, yet research on poisoned skill payloads found implicit payloads still bypassed defenses at rates of 11.6–33.5% across frameworks and models. Behavioral testing catches what static review misses.

That's the gap SkillzBench is building to close. Its Verify pillar pins every skill version to a commit SHA and runs security scans, license checks, and quality judgments; its Benchmark pillar tests each skill in a sandbox with the same model, with and without the skill, publishing the Lift in percentage points separately from a 0–100 trust score built on security, quality, license, maintenance, and community signals. At launch, instruction-only skills get full support while script-bearing skills are listed link-out only — mirroring the risk gap in the data. Equip delivers per-agent loadouts, so an agent sees only what you've explicitly chosen for it.

Until those tools ship, this checklist is your manual defense. If you'd rather put vetting, version pinning, and sandboxed benchmarking on autopilot, join the SkillzBench waitlist — the pre-launch list is live, and early subscribers get benchmark-as-a-service priority runs and launch updates as the platform comes online.