What is skill-library self-poisoning by imitation?

It is a failure mode of agents that write their own skills into a shared, writable library. An attacker plants a malicious skill and never invokes it; later, when the agent writes a new skill, it retrieves the plant as an example, imitates its structure, and copies the enclosed payload into the skill it authors — then stores and executes that. EvoMal calls the result self-poisoning because the malicious skills being counted are ones the agent wrote itself, and it reports rates of 20.3% to 41.8% across six models on 153 tool-relevant SWE-bench Verified tasks.

Why does removing the malicious skill not fix it?

Because by then the library holds copies the agent authored, not duplicates of the original. The paper reports poisoned libraries accumulating 4.9 to 9.0 times as many malicious skills as were initially planted, and Qwen3 retaining a 68% round-five poisoning rate after the planted skills are removed. It also notes that the persistence this creates can be missed by name-, code-, or signature-based defenses — each of those keys on a property of the plant, and what remains in the library was written by the agent rather than copied from the planted file.

How does this relate to prompt injection and tool security?

It is the same trust problem moved one step earlier. Classic prompt injection has untrusted content steer the agent toward an action, so a check at the call site can catch it. Here the untrusted content is never executed at all — it is read as a writing sample, and the result is a new artifact rather than a new action, which is why an invocation-time guard has nothing to fire on. The practical consequence is that a retrieved skill should be treated as untrusted input on the way in, and a writable skill library should be treated as a trust boundary rather than as storage.

EvoMal shows agents copy a planted payload into the skills they write — Skill-library self-poisoning by imitation

TL;DR

What is it: The news anchor is EvoMal, a paper on coding agents that write new skills by imitating skills retrieved from a shared library; the concept it makes concrete is skill-library self-poisoning by imitation — the agent copies a planted skill’s payload into a skill it writes itself, without ever running the planted one.
Why it’s needed: A skill library is shared, writable, and read by the agent as an example, which makes it a supply-chain boundary rather than a folder of files — and the copies it accumulates are agent-authored, so they need not match the thing a scanner was given to look for.
vs previous: The familiar attack has untrusted content steer the agent’s next action, so a check at the call site can catch it; here the untrusted content is never invoked at all — it is treated as a writing sample, and the damage is a new artifact that outlives the original.

Think of it as

a shared folder of contract templates in a law office

the shared skill library = the folder every drafter pulls a template from, and files new drafts back into
the planted malicious skill = a rogue template someone slipped in — never signed, never sent to a client
retrieval for imitation = a drafter opening that template to copy its shape while writing a new contract
the structural banner = the official-looking house header on it, which is why the drafter copies the shape whole
the copied payload = the buried clause that rides along with the shape into the new contract
storing and running the new skill = filing that new draft back into the same folder, and acting on it
persistence after removal = shredding the rogue original leaves every copy, each in a different drafter's wording
the counter-prompt defense = a cover note on the folder: copy the layout, never the clauses

Jargon

Skill: A named, reusable unit of agent capability — instructions plus the code or tool calls that carry them out — stored as a file the agent can retrieve and use later. It is a primitive the agent both reads and writes, which is what separates it from a fixed tool. See skills as a primitive →
Skill library: The store those skills live in. In the setting EvoMal studies it is shared — more than one agent draws from it — and writable, because agents file their own new skills back into it. Those two properties together are what make it a supply chain rather than a cache.
Self-evolving agent: An agent that adds to its own capabilities as it works, typically by writing a new skill when it solves something worth reusing. The paper’s subject is coding agents of this kind, which is why a skill it authors today is material it may imitate tomorrow.
Retrieval for imitation: Pulling an existing skill out of the library as a writing sample, not to execute it. The agent reads the retrieved skill to see what a well-formed skill looks like and writes a new one in that shape — so the retrieved content influences an artifact rather than an action.
Structural banner: A benign-looking header block on the planted skill. EvoMal reports using these to amplify copying; the amplification is what the paper states, and the plain reading is that a plant which looks like the house format invites being copied whole rather than read selectively.
Self-poisoning rate: The paper’s headline measurement: how often the agent writes a malicious skill of its own after being exposed to a planted one. “Self” is the load-bearing word — the count is of skills the agent authored, not of the plant being triggered.
Counter-prompt defense: The mitigation EvoMal proposes: an instruction that explicitly discourages the imitation pattern — copy the structure, not the enclosed payload. It is a prompt-level answer to a prompt-level failure, and the paper reports it cutting the rate to at most 6.7% without a significant loss in task completion.
SWE-bench Verified: A human-validated set of real GitHub issues used to measure coding agents. EvoMal runs on the 153 of its tasks that involve tools, across six models — so the numbers come from ordinary repair work, not from a purpose-built attack scenario.

The news. On August 26, 2026 a paper introducing EvoMal was posted, studying coding agents that write new tools by imitating skills retrieved from shared libraries. An attacker plants a malicious skill and never invokes it; the agent later retrieves it as an example, copies the enclosed payload into a skill it writes, stores that skill, and executes it. Across six models and 153 tool-relevant SWE-bench Verified tasks, the paper reports self-poisoning rates of 20.3% to 41.8%, rising to 86.7% when the planted description targets a task family. Poisoned libraries accumulate 4.9–9.0× as many malicious skills as were planted, and a proposed counter-prompt defense cuts the rate to at most 6.7%. Read the paper →

Picture the folder of contract templates. Every drafter in the office pulls one out when they start something new, copies its shape, changes the parts that differ, and files the finished draft back into the same folder for whoever comes next. Someone slips a rogue template into it. Nobody signs that template, nobody sends it to a client, and if you were watching the outbox you would see nothing at all — the rogue document does its damage as a model to copy, not as a document to use. By the time it matters, the clause is sitting in several other contracts, each typed in a different drafter's words.

That is the gap EvoMal is pointing at, and it is a gap in where we watch. Almost every agent guard sits at the moment of action: inspect the tool call about to run, inspect what came back, allow or block. The shape works because the familiar attack ends in an action — untrusted text steers the agent, the agent calls something it should not, and the call site is a fine place to stop it. Imitation ends somewhere else: in a file the agent writes. The planted skill is never invoked, so a check that only ever fires on invocation has nothing to fire on, and the attack surface of the tools themselves turns out to include the ones the agent has not written yet.

The mechanism is worth stating precisely, because each step is ordinary on its own. An attacker places a malicious skill in a shared library without invoking it. During later skill authoring the agent imitates the retrieved structure and copies the enclosed payload into a new skill, stores it, executes it, and can make that copy available for further imitation. EvoMal reports using benign-looking structural banners to amplify the copying; the amplification is the reported part, and the plain reading is that a plant which looks like the house format invites being copied whole. Nothing in that sequence is a step the agent was not supposed to take; the only thing that went wrong is which part of the sample it treated as content.

That is also why the usual detectors come up short. The paper's own framing is that agent-authored copies persist after the planted skills are removed, creating persistence that name-, code-, or signature-based defenses can miss — each of those keys on some property of the original, and what the library is left holding was written by the agent rather than copied from the planted file.

Defense	What it keys on	Why the copy can slip past
Name / allow-list	The identifier of the known-bad skill	The skill in the library is one the agent authored, under a name of its own (mechanism as described; the paper reports only that such defenses can miss the copies)
Code hash	An exact match on the planted file	What is stored is a skill the agent wrote, so an exact match on the plant need not hold (mechanism as described)
Signature match	A pattern drawn from the original	The paper reports persistence that name-, code-, or signature-based defenses can miss
Invocation-time policy	The call about to run	Nothing was called — the plant was read, not run (mechanism as described; the paper does not evaluate this class)
Removing the plant	The original file	Qwen3 retains a 68% round-five poisoning rate after the planted skills are removed

Now price the amplification, because a rate per task hides what a library looks like after a while. Hold the plant fixed at ten malicious skills (illustrative: the paper reports the multiplier, not a plant count) and apply the paper's own figure — poisoned libraries accumulate 4.9–9.0× as many malicious skills as initially planted. Ten planted becomes 49 to 90 malicious skills in the library. Read the same quantity the other way and it is starker: for every one skill the attacker wrote, roughly four to eight more were written by the agents themselves. Now delete the attacker's ten, which is all that deleting the known-bad file can achieve, and 39 to 80 agent-authored copies are still sitting in the folder. The paper measures that persistence separately rather than by this arithmetic, and it points the same way: Qwen3 still shows a 68% round-five poisoning rate once the planted skills are removed — a rate per round, not a count of files, but the same finding seen from the other side. The attacker's contribution is the seed; almost everything in the library by the end was written by the agents that were supposed to be using it.

Two things follow for anyone running a skill library rather than reading about one. The first is that a retrieved skill is input, and deserves whatever you already do to input — the reason this reads as an input-filter question rather than an output one is that the dangerous moment is when the sample enters the context, several steps before anything is executed. The second is that EvoMal's own fix is a prompt: an instruction that discourages the imitation pattern, reported to bring the rate down to at most 6.7% with no significant task-completion loss. That is a large reduction and it is not zero, and a defense that lives in the prompt shares the fate of the prompt — so the durable version of this lesson is architectural: a library the agent writes into is a trust boundary, and the copies it accumulates are the part worth auditing.

Goes deeper in: AI Agents → Tool Use & Function Calling → Skills as a Primitive

Related explainers

Agentic Botnets — Adversarial hallucination squatting — the other way a skill library gets poisoned: register the name the agent hallucinates, and wait for it to be fetched
COLLEAGUE.SKILL — Capability vs behavior skill tracks — what a skill is actually carrying, which is the thing being copied here
AgentDoG 1.5 — Small inline guard models for agent actions — the guard shape this attack routes around, by never producing an action to guard

Frequently Asked Questions

Check what you knowMap your AI & GPU knowledge across every track — free, role-based