Adnan KhanAdnanProduct & AI
San Francisco Bay Area
Get in touch

Source note3 min read

ColluSkill: Adversarial Cross-Skill Composition for Evading Agent Skill Scanners

Source

arXiv

arxiv.org/abs/2608.09732v1

Read the source

Source

  • Source name: arXiv
  • Source kind: paper
  • Authors / organization: Puyu Zeng, Simeng Qin, Jingzhi Li, Ju Jia, Zheli Liu, Xiaojun Jia
  • Venue: arXiv: cs.CR
  • Published: 2026-08-10
  • Collected: 2026-08-11
  • URL: http://arxiv.org/abs/2608.09732v1
  • PDF: https://arxiv.org/pdf/2608.09732v1
  • DOI: UNKNOWN
  • Registry group: academic_apis_and_preprints
  • Evidence role: canonical_academic_index
  • Language: en
  • Country / region: UNKNOWN

Plain-Language Brief

Researchers propose ColluSkill, a framework for creating multi-step attacks on LLM-based agent systems. These agents have vulnerabilities in their skill systems that current defenses don't fully address, particularly cross-skill compositions. ColluSkill breaks down a malicious intent into smaller parts embedded in separate skills and uses an LLM to plan the sequence of these parts. The researchers also introduce ChainGuard, a scanner designed to analyze skill chains and identify potential threats that only emerge at the workflow level.

What the Document Says

  • The study focuses on agent skills as an attack surface in LLM-based agent systems.
  • Current defenses mainly inspect individual skills, leaving cross-skill compositions insufficiently examined.
  • ColluSkill is a framework for creating multi-step attacks that don't rely on any single malicious skill but emerge from the ordered composition of locally plausible behaviors.
  • ColluSkill decomposes a complete malicious intent into interdependent sub-payloads embedded in independently packaged skills.
  • The attack uses contextual dependencies, artifact passing, and execution handoffs.
  • ColluSkill employs LLM-based chain planning and scanner-feedback refinement to preserve attack semantics and reduce suspicious signals.
  • ChainGuard is a proposed defense against such attacks, designed to analyze skill chains and identify potential threats that only emerge at the workflow level.
  • ChainGuard reconstructs cross-skill dependencies, artifact flows, capability compositions, and downstream behaviors to identify risks.
  • Experiments show that ColluSkill achieves an average attack success rate of 96.0%.
  • ChainGuard reduces the attack success rate to 22.5%, allowing 99.5% of benign workflows to pass

Key Concepts Mentioned

  • LLM-based agent systems
  • agent skills
  • malicious intent
  • multi-step attacks
  • collusive multi-skill-chain attack framework
  • ColluSkill
  • ChainGuard
  • cross-skill composition
  • contextual dependencies
  • artifact passing
  • execution handoffs
  • LLM-based chain planning
  • scanner-feedback refinement

Claims Made by the Document

  • Current defenses mainly inspect individual skills, leaving cross-skill compositions insufficiently examined.
  • ColluSkill achieves an average attack success rate of 96.0%
  • ChainGuard reduces the attack success rate to 22.5%

Evidence Used

  • The text describes the current state of defense for agent skills and the performance of ColluSkill and ChainGuard in experiments.

Methods / Approach

  • Empirical study of existing skill scanners
  • Proposing ColluSkill attack framework
  • Employing LLM-based chain planning and scanner-feedback refinement
  • Introducing ChainGuard scanner

Limitations Stated by the Authors

  • The study does not provide details on the specific LLM used.

Limitations Noted by the Agent

Agent interpretation — not from the source.

  • The data provided does not contain information about the specific agent systems or skills being analyzed.
  • The text does not mention any potential limitations or assumptions of ChainGuard or ColluSkill beyond those mentioned by the authors.

Open Questions

  • What specific LLM was used in this research?
  • What types of agent systems and skills were analyzed in this study?

Notes for Future Q&A

May include interpretation. Labeled where it does.

  • The text does not provide specific details about the agent systems or skills being analyzed. The researchers only mention that they focus on LLM-based agent systems.

Raw Abstract / Excerpt

Agent skills are emerging as an important attack surface in LLM-based agent systems. Through an empirical study of existing skill scanners, we find that current defenses mainly inspect individual skills, leaving risks from cross-skill composition insufficiently examined. This creates a practical blind spot: multiple locally plausible skills may pass security checks while collectively forming a harmful workflow during agent execution. To investigate this threat, we propose ColluSkill, a collusive multi-skill-chain attack framework that decomposes a complete malicious intent into interdependent sub-payloads embedded in independently packaged skills. The attack does not rely on any single malicious skill, but emerges from the ordered composition of locally plausible behaviors through contextual dependencies, artifact passing, and execution handoffs. ColluSkill further employs LLM-based chain planning and scanner-feedback refinement to preserve chain-level attack semantics while reducing suspicious signals in individual sub-skills. To defend against such attacks, we propose ChainGuard, a context-aware skill-chain scanner that jointly analyzes a candidate skill and the skills already installed in the agent environment. ChainGuard reconstructs cross-skill dependencies, artifact flows, capability compositions, and downstream behaviors to identify risks that emerge only at the workflow level. Experiments on six representative skill scanners show that ColluSkill achieves an average attack success rate of 96.0% and consistently outperforms the evaluated single-skill and multi-skill attack baselines. Meanwhile, ChainGuard reduces the attack success rate to 22.5% while allowing 99.5% of benign workflows to pass, highlighting the importance of chain-level security analysis for agent skill ecosystems.