ColluSkill: Adversarial Cross-Skill Composition for Evading Agent Skill Scanners
2026-08-10 • Cryptography and Security
Cryptography and SecurityArtificial Intelligence
AI summaryⓘ
The authors studied how language model agents use small skill modules and found that current security checks look at each skill alone, missing risks when multiple skills work together badly. They created ColluSkill, which splits a harmful goal into safe-looking pieces that become dangerous only when combined in order. To stop this, they built ChainGuard, a tool that watches how skills interact and spots harmful patterns across the whole chain. Their tests show ColluSkill can easily bypass existing scanners, but ChainGuard catches most attacks while letting safe skill groups through.
LLM (Large Language Model)Agent skillsSkill scannersCross-skill compositionColluSkillChainGuardMalicious workflowsContextual dependenciesSkill-chain securityExecution handoffs
Authors
Puyu Zeng, Simeng Qin, Jingzhi Li, Ju Jia, Zheli Liu, Xiaojun Jia
Abstract
Agent skills are emerging as an important attack surface in LLM-based agent systems. Through an empirical study of existing skill scanners, we find that current defenses mainly inspect individual skills, leaving risks from cross-skill composition insufficiently examined. This creates a practical blind spot: multiple locally plausible skills may pass security checks while collectively forming a harmful workflow during agent execution. To investigate this threat, we propose ColluSkill, a collusive multi-skill-chain attack framework that decomposes a complete malicious intent into interdependent sub-payloads embedded in independently packaged skills. The attack does not rely on any single malicious skill, but emerges from the ordered composition of locally plausible behaviors through contextual dependencies, artifact passing, and execution handoffs. ColluSkill further employs LLM-based chain planning and scanner-feedback refinement to preserve chain-level attack semantics while reducing suspicious signals in individual sub-skills. To defend against such attacks, we propose ChainGuard, a context-aware skill-chain scanner that jointly analyzes a candidate skill and the skills already installed in the agent environment. ChainGuard reconstructs cross-skill dependencies, artifact flows, capability compositions, and downstream behaviors to identify risks that emerge only at the workflow level. Experiments on six representative skill scanners show that ColluSkill achieves an average attack success rate of 96.0% and consistently outperforms the evaluated single-skill and multi-skill attack baselines. Meanwhile, ChainGuard reduces the attack success rate to 22.5% while allowing 99.5% of benign workflows to pass, highlighting the importance of chain-level security analysis for agent skill ecosystems.