CompoSkill Shows Agent Skills That Pass Individual Scans Can Still Form Risk Chains at Rates of Up to 80% When Composed

Agent skill marketplaces typically scan packages individually: as long as each `SKILL.md`, script, and dependency is not classified as malicious, the installed combination is considered safe. CompoSkill, submitted on August 17, argues that this model overlooks how agents actively connect the outputs, permissions, and side effects of different skills over long workflows. Individually benign capabilities—such as reading files, uploading data to the cloud, or sending messages—can, once connected through model-driven planning, create paths for data exfiltration or unauthorized actions.

The researchers developed two types of attackers. The white-box version knows the set of skills installed by the victim and can directly inject an explicit sequence of skill IDs. The black-box version receives only a description of the user’s role, constructs a Skill Composition Graph from popular marketplace skills, searches it for high-risk chains, and generates implicit inducements that do not name specific skills directly. This design tests whether the agent can complete an attack path on its own, rather than merely whether a scanner can identify a single piece of malicious text.

CompoSkill-Bench contains 1,140 long-horizon professional workflows spanning five threat categories and six scenarios, tested on OpenClaw and Nanobot. The paper reports maximum Chain Formation Rates of 83.3% for white-box attacks and 80.6% for black-box attacks; existing per-skill scanners intercepted only a limited subset. The authors also observed a “bridging gain, hop decay” effect: adding bridging skills can increase the chance of success, but once a chain exceeds three skills, the attack success rate declines instead.

For platform engineering, defenses therefore need to move to the composition and execution stages. Measures should include building capability and data-flow graphs, restricting cross-skill value passing, applying taint tracking to sensitive sources, and rechecking destinations and user authorization when tools are actually invoked. The figures still require cautious interpretation: Chain Formation Rate measures whether a dangerous composition is formed, not whether data was successfully stolen. The study also covers only two agent systems and manually constructed scenarios. The next step should be to release the benchmark and attack generator publicly, then measure actual blocking rates when signatures, static analysis, sandboxing, and least-privilege policies are combined.