MetaCascade: End-to-End Attacks on Agent Skills via Metadata-Only Poisoning

Abstract

As a key extension mechanism for agent systems, Agent Skills package specialized capabilities for reuse by LLM agents. An agent first retrieves candidate skills based on skill documentation and then relies on their metadata to make the final selection. As third-party skills proliferate on insufficiently vetted open registry platforms, the security risks posed by malicious skills become increasingly prominent, but existing attack research still focuses primarily on the potential harm caused after their execution. The limited related studies typically examine skill retrieval or selection in isolation and have yet to cover a complete end-to-end attack chain. To address this research gap, we find an end-to-end attack surface arising from the process-wide influence of metadata. Based on this finding, we propose MetaCascade, an end-to-end metadata-only poisoning framework. MetaCascade first generates diverse malicious skill candidates through multi-view semantic expansion, then uses tasks and black-box competition feedback to analyze the competitive relationships among malicious candidate skills and iteratively optimize malicious metadata, thereby improving the target skill's end-to-end attack effectiveness. Under a unified evaluation setting spanning four datasets and two agents, Hermes and OpenClaw, MetaCascade achieves state-of-the-art attack performance, with its average attack success rate (ASR) and its average ASR under four defense settings exceeding the strongest baselines under the corresponding settings by 35.53 and 34.65 percentage points, respectively. Our code is provided in the supplementary material.