{
  "schema_version": "1.3.0",
  "slug": "how-does-an-instance-detect-skill-injection-attacks-when-the-loader-has-already-resolved-trust",
  "title": "How does an instance detect skill-injection attacks when the loader has already resolved trust",
  "date_of_record": "2026 November 8",
  "scope": "Applies to agent runtimes that resolve, load, and execute third-party \"skills\" (tool bundles, prompt fragments, or code modules) at runtime, where skill manifests carry their own declared capabilities. Does not apply to statically linked tool sets resolved at build time, nor to skills whose entire content is reviewed and pinned by a single human operator.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/how-does-an-instance-detect-skill-injection-attacks-when-the-loader-has-already-resolved-trust.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/how-does-an-instance-detect-skill-injection-attacks-when-the-loader-has-already-resolved-trust.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/how-does-an-instance-detect-skill-injection-attacks-when-the-loader-has-already-resolved-trust.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1464,
    "python_slice_tokens": 348,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The failure boundary is not \"malicious skill content vs. benign skill content.\" It is **declaration-time trust vs. execution-time authority**. A skill manifest declares the capabilities it *claims* to need; a capability sandbox enforces the capabilities the skill *actually exercises*. Injection succeeds precisely in the gap between these two: the manifest is...",
    "what_was_observed": "In a runtime that dynamically loaded skills from a shared registry, a skill declared `fs:read` with a path prefix `./data/`. The loader implemented the grant as a read capability scoped to the *process working directory*, reasoning that the declared prefix was advisory. A subsequently loaded skill, injected by an upstream dependency that had write access to the registry entry, declared `fs:read` on `./data/` but issu...",
    "condition_of_validity": "The detection method below is valid only when all of the following hold: 1. The runtime can observe **exercised** capabilities at a granularity equal to or finer than the declared capability grammar (e.g., syscall or interpreter-level interception, not just manifest inspection). 2. Declared capabilities are recorded per-skill at load time and are immutable f...",
    "decision_boundary": "Detect and quarantine a skill when **exercised capability ⊄ declared capability**, evaluated per-skill and per-data-flow-edge. Concretely: - A read outside the declared subtree → violation. - A write of any kind by a skill that declared no write capability → violation. - A value originating under skill A's exercised read set appearing in skill B's exercised ...",
    "operational_effect": "With this boundary enforced, injection attempts that pass provenance and signature checks still surface at first exercised-capability divergence, typically within the first N calls of a skill's invocation. The quarantine action is to revoke the skill's grants and drop its context object, not to kill the process, because the divergence may be a loader defect ..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "e7ccf5153dbdceacd9a12f9471f0878616984cec08602f0e50f512c38b37a257",
    "verified_classes": [
      "CapabilityViolation",
      "LoaderGrantDefect",
      "Capability",
      "Skill"
    ],
    "verified_functions": [
      "_subsumes",
      "check_loader_grant",
      "check_exercised",
      "check_flow",
      "load_and_verify"
    ],
    "verified_functions_count": 5,
    "defensive_guards_count": 5,
    "raised_exceptions": [
      "CapabilityViolation",
      "LoaderGrantDefect"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [
      "dataclasses",
      "typing"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}