Surviving the Router: Optimizing Skill Injections for Retrieval and Execution

What it is

CORSA (Cluster Optimization for Router-Aware Skill Attacks), from Najjar, Scionis, Puerto, and Abdelnabi. It attacks the retrieval step of agent skill marketplaces (Claude/OpenAI/OpenClaw-style SKILL.md ecosystems), not just the execution step that prior skill-injection work targeted.

How it works

A skill is modeled as (name, description, body, artifacts). The attacker edits the name, description, and body of a malicious skill — the payload itself stays fixed — using GEPA (Genetic-Pareto), a reflective evolutionary text optimizer that revises candidates based on task-level feedback rather than gradients. Optimization runs in two sequential stages over a cluster of related tasks (3–13 tasks sharing domain vocabulary) rather than a single query or the whole task pool:

• Stage A optimizes purely for retrieval: reward = 1 if the router ranks the skill #1 among competitors.
• Stage B, initialized from Stage A's winner, optimizes the joint reward: ranked #1 and payload execution confirmed via execution trace/filesystem state.

Attacker model: can publish skills publicly, has query access to the router's scoring function and offline query access to the victim LLM, but no weight access and cannot touch other skills, the system prompt, or the user task.

Preconditions / Affected

Applies to agent systems using a skill router that selects among multiple candidate SKILL.md packages from a marketplace/pool (benchmark tested against ~2,000–80,000 competing skills, easy/hard settings with topically-related distractors). Eight payload categories were tested: data exfiltration, data destruction, DoS, malware/ransomware, phishing, backdoors, model-output manipulation, and data/model poisoning.

What to do

The page (through the excerpt available) does not give a mitigation or detection procedure — it names a complementary defense (SKILLGUARD: runtime permission restrictions on what a skill can trigger) and pre-install inspection approaches as related work, but doesn't specify configuration or commands. For risk assessment: if you operate or evaluate a skill marketplace/router, treat router-ranking position as an exploitable surface, not just execution-time instruction content — naive injections already fail 87–97% of the time by degrading their own retrieval rank, but a router-aware attacker can recover near-original attack success while preserving the skill's advertised utility (so it won't look broken on inspection).

Caveats

The attacker in this threat model has query access to the router's scoring function and offline access to the victim LLM for evaluation during optimization — a capability stronger than opportunistic marketplace attackers may have. The paper's own framing is that this demonstrates a realistic lower bound was wrong (prior ASR estimates were too optimistic/pessimistic in the wrong direction depending on framing), not that marketplaces are currently being exploited this way.