Surviving the Router: Optimizing Skill Injections for Retrieval and Execution

AI agents increasingly rely on modular third-party “skills” that are dynamically selected by skill routers to execute complex tasks. While recent studies highlight the threat of prompt injections embedded in these skills, existing evaluations of- ten assume settings where the malicious skill is already selected for execution. We show that this assumption can substantially overestimate attack success. In realis- tic multi-skill environments, injected skills must first compete for retrieval, reduc- ing the effective attack success rate (ASR) of existing injections by 87–97%. To address this limitation, we introduce CORSA (Cluster Optimization for Router- Aware Skill Attacks), a router-aware attack that optimizes skill injections for both retrieval and execution across clusters of related tasks. We evaluate skill injection attacks under router-managed multi-skill settings by extending the benchmark in- troduced by SkillRouter with eight malicious payload categories. CORSA uses successive optimization stages to first improve retrieval and then optimize end-to- end attack success, while we evaluate user utility and injection naturalism sepa- rately. Our experiments show that CORSA substantially improves both retrieval and end-to-end attack success over existing skill injections while preserving user utility, and that the resulting attacks transfer across different router architectures and LLM backbones.