CompoSkill: Agent Skills That Each Pass a Safety Scanner Chain Into Attacks 83.3% of the Time

arXiv 2608.16246·high signalXBlueskyLinkedInCopy link

The paper attacks the core assumption of skill marketplaces — that per-package certification makes the ecosystem safe — by showing composition risk is a path-level, not node-level, property. A black-box attacker that knows only a role profile downloads top marketplace skills, builds a Skill Composition Graph, and searches for risky chains whose lures never name skill identifiers, hitting 80.6% Chain Formation Rate (83.3% white-box) on CompoSkill-Bench, 1,140 records across five threats and six scenarios on OpenClaw and Nanobot. Existing scanners block only a limited fraction; attack success also decays past three hops, giving a concrete bound defenders can design around.