Action trace
A record of actions proposed or invoked during a workflow. It should be correlated with verified effects.
Explore this concept ↗THE SKILL POISONING GLOSSARY
Clear terms.
Better decisions.
55 concise definitions, each linked to a guide that explains its relevance to reusable agent skills.
55 terms
Admission review
The decision process for allowing a package into an approved environment under a defined scope.
Explore this concept ↗Agent skill
A reusable package of task guidance and optional resources that extends an agent’s workflow.
Explore this concept ↗Attack success rate
The share of evaluated cases meeting a study’s definition of successful attack. It depends on the denominator and configuration.
Explore this concept ↗Authority boundary
An enforced limit on data access or actions available to a package-driven workflow.
Explore this concept ↗Backdoor
Hidden behavior that activates under particular conditions while a component may otherwise behave normally.
Explore this concept ↗Behavioral verification
Checking observed actions or effects rather than inferring behavior from text alone.
Explore this concept ↗Bundled script
Executable code distributed with a skill and used by its workflow.
Explore this concept ↗Canary value
A synthetic marker used in an isolated test to observe access or movement without exposing a real secret.
Explore this concept ↗Claim ledger
A record tying a statement to its source version, conditions, and verification limits.
Explore this concept ↗Containment
Runtime limits on reachable files, networks, processes, or actions to restrict the effects of unsafe behavior.
Explore this concept ↗Coverage manifest
A record of expected artifacts and which were fully, partially, or unsuccessfully inspected.
Explore this concept ↗Cross-session artifact
A file or record that persists after one agent session and influences a later skill run.
Explore this concept ↗Derived artifact
A skill or revision produced from an earlier record or component.
Explore this concept ↗Documentation-to-action boundary
The transition where an example or template influences an executable artifact or action.
Explore this concept ↗Dual-purpose skill
A package that may complete the visible task while performing an additional unauthorized action.
Explore this concept ↗Evidence tier
A label describing how directly a finding is supported, according to a tool’s stated criteria.
Explore this concept ↗Experience-to-skill pipeline
The process that turns task histories into persistent reusable procedures.
Explore this concept ↗False negative
A malicious or unsafe case that a detector fails to flag under its stated criteria.
Explore this concept ↗False positive
A benign case incorrectly flagged or blocked by a detector or policy.
Explore this concept ↗Handoff contract
An explicit description of the data and validation expected between two workflow components.
Explore this concept ↗Human handoff
A transition where an agent asks a person to perform an action outside the agent’s enforced environment.
Explore this concept ↗Indirect prompt injection
An instruction-manipulation attempt arriving through content the agent reads, such as a skill reference, instead of the direct user request.
Explore this concept ↗Instruction boundary
The distinction between task guidance a source may provide and actions it is authorized to request.
Explore this concept ↗Integrity
Whether an artifact matches a recorded state. Matching bytes do not prove safe behavior.
Explore this concept ↗Intermediate artifact
A file or record passed between stages or skills; its source can matter to the final action.
Explore this concept ↗Least privilege
Granting only the capabilities and access required for an approved use case.
Explore this concept ↗Metadata poisoning
Misleading or malicious discovery content that influences how a skill is found, selected, or interpreted.
Explore this concept ↗Model-bearing skill
A skill that includes a learned model artifact as part of its logic.
Explore this concept ↗Mutable reference
Supporting content that can change independently of the installed skill revision.
Explore this concept ↗Observation window
The time period covered by collection or analysis, which may differ from publication date.
Explore this concept ↗Output contract
An explicit statement of the criteria and constraints a generated result must satisfy.
Explore this concept ↗Output integrity
Whether the result follows the user’s authorized criteria, sources, and recipients.
Explore this concept ↗Post-loading evaluation
A test beginning after a skill has loaded; it does not by itself evaluate discovery or installation.
Explore this concept ↗Pre-execution detector
A method that screens material before it runs; a positive result is not evidence of completed impact.
Explore this concept ↗Preprint
A research manuscript shared before or separately from a final peer-reviewed publication.
Explore this concept ↗Prerequisite trap
A setup claim used to make a legitimate task conditional on an unverified or unrelated installation.
Explore this concept ↗Pretext
Context presented as the reason a later skill should act; review its origin and integrity.
Explore this concept ↗Progressive disclosure
Loading metadata, instructions, and supporting resources as they are needed, rather than exposing the entire package at once.
Explore this concept ↗Provenance
Evidence of where a package or artifact came from and how it reached the reviewed environment.
Explore this concept ↗Revocation
Removing a package’s availability or access after approval is withdrawn.
Explore this concept ↗Rollback
Returning artifacts or configuration to a previously reviewed state; external effects may need separate recovery.
Explore this concept ↗SKILL.md
The entry file used by the Agent Skills format for metadata and Markdown instructions.
Explore this concept ↗Skill composition
Using multiple skills or their outputs together in a workflow.
Explore this concept ↗Skill extraction
Producing a reusable procedure from examples or completed interactions.
Explore this concept ↗Skill poisoning
Malicious instructions or behavior introduced through a reusable skill or its supply chain. A working umbrella in this library.
Explore this concept ↗Source-disjoint evaluation
Testing on sources held out from training or tuning to probe source-dependent generalization.
Explore this concept ↗Structural family
A group of closely related artifacts considered together when controlling evaluation overlap.
Explore this concept ↗Trigger
A condition associated with activating hidden behavior in a backdoored component.
Explore this concept ↗Truncated analysis
Inspection limited to part of an artifact; the unprocessed remainder remains outside the finding.
Explore this concept ↗Utility
The extent to which a system completes legitimate tasks in the evaluated conditions.
Explore this concept ↗Version pinning
Identifying and retaining the exact package or dependency state approved for a workflow.
Explore this concept ↗No matching terms.