Adnan KhanAdnanProduct & AI
San Francisco Bay Area
Get in touch

Source note3 min read

ColluSkill: Adversarial Cross-Skill Composition for Evading Agent Skill Scanners

Source

arXiv

arxiv.org/abs/2608.09732v1

Read the source

Source

  • Source name: arXiv
  • Source kind: paper
  • Authors / organization: Puyu Zeng, Simeng Qin, Jingzhi Li, Ju Jia, Zheli Liu, Xiaojun Jia
  • Venue: arXiv: cs.CR
  • Published: 2026-08-10
  • Collected: 2026-08-11
  • URL: http://arxiv.org/abs/2608.09732v1
  • PDF: https://arxiv.org/pdf/2608.09732v1
  • DOI: UNKNOWN
  • Registry group: academic_apis_and_preprints
  • Evidence role: canonical_academic_index
  • Language: en
  • Country / region: UNKNOWN

Plain-Language Brief

Researchers propose ColluSkill, a framework for multi-skill attacks that can bypass individual skill checks in LLM-based agent systems. These attacks are composed of locally plausible behaviors that collectively form harmful workflows. The study also introduces ChainGuard, a context-aware scanner to defend against such attacks by analyzing the complete workflow rather than individual skills.

What the Document Says

  • Agent skills are an important attack surface in LLM-based agent systems.
  • Current defenses inspect individual skills, leaving risks from cross-skill composition insufficiently examined.
  • The authors propose ColluSkill, a collusive multi-skill-chain attack framework that decomposes malicious intent into interdependent sub-payloads embedded in independently packaged skills.
  • ColluSkill does not rely on any single malicious skill but emerges from the ordered composition of locally plausible behaviors.
  • The attack is facilitated through contextual dependencies, artifact passing, and execution handoffs.
  • ColluSkill employs LLM-based chain planning and scanner-feedback refinement to preserve chain-level attack semantics while reducing suspicious signals in individual sub-skills.
  • The study also proposes ChainGuard, a context-aware skill-chain scanner that analyzes the candidate skill and skills already installed in the agent environment.
  • ChainGuard reconstructs cross-skill dependencies, artifact flows, capability compositions, and downstream behaviors to identify risks.
  • Experiments show that ColluSkill achieves an average attack success rate of 96.0%, outperforming evaluated single-skill and multi-skill attack baselines.
  • ChainGuard reduces the attack success rate to 22.5% while allowing 99.5% of benign workflows to pass.

Key Concepts Mentioned

  • Agent skills
  • LLM-based agent systems
  • ColluSkill
  • multi-skill-chain attack
  • ChainGuard
  • context-aware skill-chain scanner

Claims Made by the Document

  • Current defenses inspect individual skills, leaving risks from cross-skill composition insufficiently examined.
  • ColluSkill achieves an average attack success rate of 96.0%
  • ChainGuard reduces the attack success rate to 22.5%

Evidence Used

  • Empirical study of existing skill scanners
  • Experiments on six representative skill scanners

Methods / Approach

  • ColluSkill framework for multi-skill attacks
  • LLM-based chain planning and scanner-feedback refinement
  • ChainGuard, a context-aware skill-chain scanner

Limitations Stated by the Authors

  • Not stated in source

Limitations Noted by the Agent

Agent interpretation — not from the source.

  • The research might not consider all possible ways attackers could bypass the proposed defense mechanism.
  • The effectiveness of ColluSkill and ChainGuard may vary depending on the specific LLM-based agent system being used.

Open Questions

  • What other methods can be developed to detect and prevent such multi-skill attacks?
  • How could the performance of ColluSkill and ChainGuard be improved?

Notes for Future Q&A

May include interpretation. Labeled where it does.

  • It would be interesting to explore how generalizable these findings are across different LLM-based agent systems.
  • Further research could focus on developing more sophisticated defense mechanisms against multi-skill attacks.

Raw Abstract / Excerpt

Agent skills are emerging as an important attack surface in LLM-based agent systems. Through an empirical study of existing skill scanners, we find that current defenses mainly inspect individual skills, leaving risks from cross-skill composition insufficiently examined. This creates a practical blind spot: multiple locally plausible skills may pass security checks while collectively forming a harmful workflow during agent execution. To investigate this threat, we propose ColluSkill, a collusive multi-skill-chain attack framework that decomposes a complete malicious intent into interdependent sub-payloads embedded in independently packaged skills. The attack does not rely on any single malicious skill, but emerges from the ordered composition of locally plausible behaviors through contextual dependencies, artifact passing, and execution handoffs. ColluSkill further employs LLM-based chain planning and scanner-feedback refinement to preserve chain-level attack semantics while reducing suspicious signals in individual sub-skills. To defend against such attacks, we propose ChainGuard, a context-aware skill-chain scanner that jointly analyzes a candidate skill and the skills already installed in the agent environment. ChainGuard reconstructs cross-skill dependencies, artifact flows, capability compositions, and downstream behaviors to identify risks that emerge only at the workflow level. Experiments on six representative skill scanners show that ColluSkill achieves an average attack success rate of 96.0% and consistently outperforms the evaluated single-skill and multi-skill attack baselines. Meanwhile, ChainGuard reduces the attack success rate to 22.5% while allowing 99.5% of benign workflows to pass, highlighting the importance of chain-level security analysis for agent skill ecosystems.