SkillJect: Effectively Automating Skill-Based Prompt Injection for Skill-Enabled Agents

Agent skills are increasingly used to extend LLM agent systems with task-specific instructions, executable scripts, and auxiliary resources. While this modular design improves reusability, it also creates a new supply-chain attack surface: a malicious or compromised skill can be repeatedly loaded as trusted guidance and steer an agent's tool use during downstream execution. Existing skill-based prompt-injection attacks are largely manual and brittle, since explicit malicious instructions are often rejected or ignored when they are not well aligned with the original skill workflow. We propose SkillJect, the first automated framework for generating effective poisoned skills against skill-enabled agent systems. SkillJect separates the attack into two coordinated channels. In the artifact channel, it hides the malicious payload inside an auxiliary helper script. In the instruction channel, it rewrites SKILL.md with a front-loaded inducement strategy, placing the injected content at the beginning of the document and framing the helper script as a mandatory prerequisite or required first step. The injected instruction explicitly references the helper-script path and provides an executable example command, making the helper appear to be a legitimate initialization step before normal skill operations. SkillJect further uses a closed-loop multi-agent-system process to improve attack performance. An Attack Agent generates injected skills, a Victim Agent executes downstream tasks with the poisoned skill, and an Evaluate Agent inspects execution traces to determine whether the hidden payload is executed. The Attack Agent then uses this feedback to identify why the payload was not executed and rewrites SKILL.md, producing an updated poisoned skill while keeping the payload fixed. Experiments across skill-enabled platforms, backend LLMs, and attack categories show that SkillJect substantially outperforms naive direct injection and prior manual skill-injection attacks.