Poison ivy

It's possible to hurt someone by purifying poison ivy and smearing it in various places that they frequent (e.g. doorknobs in their home). The substance, urushiol, is a clear oil that sticks to many surfaces. It always takes 4-72 hours from exposure before a rash appears, so the victim may have no idea how they became exposed to poison ivy. If the attacker had a biochemistry background, then US patent# 9580373 "Extraction and purification of urushiol from botanical sources" shows the steps.

Note that there's a risk of more severe harm in some unusual cases. Some individuals know that they have severe allergic reactions to urushiol. Also, if urushiol becomes ingested or inhaled (for example, fire can aerosolize the oil), then the victim will probably have a severe systemic reaction.   (Caveat: the hard science is actually uncertain about this, though many firefighters personally attest to this.) Signs of a particularly severe reaction is if someone's eyes swell shut or blisters erupt on their skin; this is a medical emergency and requires prompt care.

Random facts:

• Urushiol is potent. When someone is exposed to urushiol, the average amount is 0.1 micrograms. A quarter ounce (10 g) is enough to give everyone on Earth a rash.
• It's normal for urushiol oil to stay active most surfaces, including dead plants, for 1 to 5 years. When someone gets a rash, in many cases they have gotten it from clothing that has rubbed against something with the oil on it, which contaminated the cloth.
• Only humans and perhaps some primates get a rash from urushiol.