Agent skills provide a lightweight mechanism for extending general-purpose agents, but their open format exposes them to skill-poisoning attacks. A practically dangerous injection must stay invisible: if executing the payload derails the user's legitimate task, the resulting failure signal invites inspection of the skill. We therefore evaluate attacks by Attack Success Rate, which requires the injected payload to execute and the user's task to still pass its verifier in the same trial. Prior skill-poisoning attacks face a reliability-stealth trade-off under this lens: YAML-header injections are reliably loaded but easily inspected, whereas stealthier body injections that place explicit malicious commands in the skill prose are less reliable because out-of-context commands invite the agent's own suspicion. We introduce POISE, a position-aware attack that compresses the trigger into a single, benign-looking body instruction, placing it at a feasible position and using a context-aware generator to blend it with nearby setup or prerequisite steps. On Skill-Inject with codex+gpt-5.2, POISE achieves an 89.3% ASR, 28.0 points above a random-placement body baseline and 2.6 points above a YAML-only baseline, while retaining the stealth advantage of body placement. That stealth is the decisive margin: because legitimate skill bodies naturally require privileged tool operations, LLM scanners are hyper-sensitive, falsely flagging 74.6% of clean skills on average across four judges and both benchmarks. Blending into these false alarms, POISE causes only 5.6% of poisoned variants to gain a new high-risk alert over their clean baselines, rendering current static defenses ineffective.

翻译：摘要：智能体技能为扩展通用型智能体提供了轻量级机制，但其开放式格式使其容易遭受技能投毒攻击。具有实际危险性的注入必须保持隐形：若执行恶意载荷导致用户合法任务偏离轨道，由此产生的失败信号将引发对技能的审查。因此，我们通过攻击成功率（ASR）评估攻击效果，该指标要求注入的恶意载荷成功执行，且用户任务在同一轮次中仍能通过验证器。在此评估框架下，既有技能投毒攻击面临可靠性-隐蔽性权衡：YAML头部注入虽能可靠加载却易于被检测，而将显式恶意命令嵌入技能文本的隐蔽性更强的正文注入，因上下文无关的命令易引发智能体自身怀疑而可靠性降低。为此，我们提出POISE——一种位置感知攻击方法，将触发器压缩为单个外观良性的正文指令，将其置于可行位置，并通过上下文感知生成器使其与邻近的配置或前提步骤自然融合。在基于Codex+GPT-5.2的Skill-Inject基准测试中，POISE达到89.3%的攻击成功率，较随机位置正文基线提升28.0个百分点，较纯YAML基线提升2.6个百分点，同时保留正文注入的隐蔽性优势。这种隐蔽性构成决定性差距：由于合法技能正文天然需要特权工具操作，LLM扫描器处于超敏感状态，在四个评估器及两个基准测试中平均将74.6%的清洁技能误报为高风险。POISE通过混入这些误报中，仅使5.6%的投毒变体相较于清洁基线产生新的高风险警报，导致现有静态防御机制失效。