Supply-Chain Poisoning Attacks Against Agent Skill Ecosystems (April 2026)

Free

DDIPE attack embeds malicious logic in skill documentation code examples; 1,070 adversarial skills across 15 MITRE ATT&CK categories; 11.6–33.5% bypass rate; responsible disclosure led to 4 confirmed vulnerabilities and 2 patches

FreeFree tier

Type

Open Source

Visit Website GitHub (40 stars)

About Supply-Chain Poisoning Attacks Against Agent Skill Ecosystems (April 2026)

This paper introduces Document-Driven Implicit Payload Execution (DDIPE), a supply-chain poisoning attack against LLM-based coding agent skill ecosystems. DDIPE embeds malicious logic in code examples and configuration templates within skill documentation. Because coding agents reuse these examples during normal tasks, the payload executes without requiring explicit prompts. Using an LLM-driven pipeline, the researchers generated 1,070 adversarial skills from 81 seeds across 15 MITRE ATT&CK categories. Evaluated across four frameworks and five models, DDIPE achieved bypass rates between 11.6% and 33.5%, while explicit instruction attacks achieved 0% under strong defenses. Static analysis detected most cases, but 2.5% of skills evaded both detection and alignment. Responsible disclosure resulted in four confirmed vulnerabilities and two fixes.

Key Features

Document-Driven Implicit Payload Execution (DDIPE) embeds malicious logic in code examples and configuration templates within skill documentation

LLM-driven pipeline generates 1,070 adversarial skills from 81 seed skills across 15 MITRE ATT&CK categories

Achieves 11.6% to 33.5% bypass rates across four frameworks and five models

Static analysis detects most adversarial skills, but 2.5% evade both detection and alignment defenses

Responsible disclosure led to four confirmed vulnerabilities and two patches in affected frameworks

Pros & Cons

Pros

Demonstrates a novel attack vector (DDIPE) that exploits implicit reuse of documentation examples
Comprehensive evaluation across multiple frameworks (4) and models (5) with detailed bypass rate analysis
Responsible disclosure practices resulted in confirmed vulnerabilities and patches
Provides insights into detection gaps (static analysis vs. alignment defenses)

Cons

Attack has relatively high bypass rates (11.6–33.5%) in default configurations
Limited to LLM coding agents that reuse skill documentation examples
Static analysis can detect most but not all adversarial skills (2.5% evade)

Best For

Security research on supply-chain attacks against LLM coding agent ecosystemsVulnerability assessment for agent skill marketplaces and platformsDesigning defenses against implicit payload execution in skill documentation

FAQ

What is the DDIPE attack?

Document-Driven Implicit Payload Execution (DDIPE) is a supply-chain poisoning attack that embeds malicious logic in code examples and configuration templates within LLM coding agent skill documentation. Because agents reuse these examples during normal tasks, the payload executes without explicit prompts.

How effective is the attack?

Across four frameworks and five models, DDIPE achieves bypass rates ranging from 11.6% to 33.5%. Explicit instruction attacks achieved 0% under strong defenses. Static analysis detects most cases, but 2.5% evade both detection and alignment.

What was the outcome of responsible disclosure?

Responsible disclosure led to four confirmed vulnerabilities and two fixes in affected agent skill frameworks.