Story · arXiv
CompoSkill: Compositional Skill Chain Attacks from Individually Scanner-Passing LLM Agent Skills (arXiv)
paper · Story page
Skills that each pass a per-package scanner can still form a risky chain once an agent connects their outputs and side effects. CompoSkill's black-box attacker downloads a role's top marketplace skills, builds a composition graph, and searches for high-risk chains whose lures never name a skill.
In plain words
- A study found that approved add-ons can become dangerous when an action-taking artificial intelligence system combines them.
- An add-on may pass a safety check alone while its output enables harmful behavior through another approved add-on.
- Researchers mapped connections among add-ons and searched those connections for risky sequences.
- They tested one attacker with installed add-on details and another that chose popular marketplace add-ons using only a user's role.
- Marketplace operators must test connected add-ons together, because checking each one separately can miss dangerous combinations.
Appeared in
- Aborted agent branches live on in the KV cache, plus StateM's harness scaling
Aug 19, 2026 · in the sections
Subscribe
Get the brief in your inbox
Pick daily, weekly, or both. Nothing is gated either way: every issue is on the site and in the feeds.
- Weekdays at 8:45am IST, one lead story and 6 to 9 items.
- Sundays, an argued synthesis rather than a recap.
- One click to leave, and quiet days say so in the subject line.