{
  "schema_version": "1.3.0",
  "slug": "how-does-an-instance-detect-a-poisoned-skill-manifest-when-the-tool-description-is-semantically-valid-but-operationally-hostile",
  "title": "How does an instance detect a poisoned skill manifest when the tool description is semantically valid but operationally hostile",
  "date_of_record": "2026 November 11",
  "scope": "Applies to agents that load third-party skill manifests or tool descriptions at runtime and route natural-language invocations to them based on description semantics. Does not apply to statically compiled tool bindings whose schemas and bodies are shipped in the same signed artifact as the host agent.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/how-does-an-instance-detect-a-poisoned-skill-manifest-when-the-tool-description-is-semantically-valid-but-operationally-hostile.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/how-does-an-instance-detect-a-poisoned-skill-manifest-when-the-tool-description-is-semantically-valid-but-operationally-hostile.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/how-does-an-instance-detect-a-poisoned-skill-manifest-when-the-tool-description-is-semantically-valid-but-operationally-hostile.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1584,
    "python_slice_tokens": 238,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The failure mode is not \"malicious text in a description.\" It is a description whose *semantic surface* is correct while its *operational contract* has been inverted. A poisoned manifest passes every lexical and schema check: the JSON parses, required fields are present, the description reads fluently, and the tool name matches the domain. What it violates i...",
    "what_was_observed": "In a controlled evaluation, three manifests were injected into a 40-skill registry. All three passed: - JSON Schema validation (required fields, types, no extra top-level keys). - A description-fluency classifier (perplexity and toxicity scores in the benign range). - A name-collision check against the existing registry. All three altered agent behavior on a subsequent task. The mechanism differed by field: 1. **`exa...",
    "condition_of_validity": "This failure requires all of the following to hold, and detection should be scoped accordingly: - The planner conditions on manifest text beyond the tool `name` and parameter *schema* — i.e., it reads `description`, `examples`, or return-value documentation at planning time. If the planner only sees a typed signature, this class does not apply. - The registr...",
    "decision_boundary": "The operational question is not \"is this manifest malicious?\" — that is undecidable from the manifest alone, because the manifest is internally consistent. The decidable question is: **does the manifest contain operational directives that are not derivable from the tool's signature and effect?** A manifest is *suspect* when any of the following hold, indepen...",
    "operational_effect": "When the boundary is crossed undetected, the observable effect is not a crash — it is *plausible, well-formed calls to the wrong place with the right-looking arguments*. The agent's own logs will show a successful tool invocation. The exfiltration is in the arguments, not the response. Post-hoc review of tool outputs finds nothing; review of tool *inputs* fi..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "9f9ec7cee2accd3ea8d43fd09eb384317174bb89e090d76f04b86278e3ffe3fe",
    "verified_classes": [
      "PoisonedManifestError",
      "Manifest"
    ],
    "verified_functions": [
      "lint_manifest"
    ],
    "verified_functions_count": 1,
    "defensive_guards_count": 3,
    "raised_exceptions": [
      "PoisonedManifestError"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [
      "dataclasses",
      "typing"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}