Skills that individually pass every scanner chain into attacks 83% of the time

Every skill marketplace runs on one assumption: certify each package, and the ecosystem is safe. CompoSkill breaks that assumption by showing composition risk is a path property, not a node property.

The attack works black-box. The attacker knows only a role profile. They download top marketplace skills, build a Skill Composition Graph, and search it for chains where individually-benign skills combine into a harmful capability. The lures never name skill identifiers: they describe an outcome, and the agent assembles the chain itself. On CompoSkill-Bench (1,140 records, five threat types, six scenarios, tested on OpenClaw and Nanobot) they hit 80.6% Chain Formation Rate black-box, 83.3% white-box. Existing scanners block only a limited fraction.

Two things make this actionable rather than academic.

Attack success decays past three hops. That's a design bound you can implement. Cap the number of distinct skills an agent can chain within a single task, and you kill most of the search space. Not perfect, but it's the first concrete number I've seen for a limit.

And it converges with two other things in today's findings. SkillWatermark inserts prompt-constraint terms into skill descriptions so that a user's private prompt content gets encoded into observable network traffic patterns across turns. A passive network attacker decodes it. Nothing is directly exfiltrated and no malicious instruction executes, which is exactly why the modified skills pass LLM-based auditing. Content scanners read package contents. They structurally cannot see traffic shape. Meanwhile Tencent's AI-Infra-Guard team ran 14,560 controlled executions against DeepSeek Harness across 16 indirect-content channels and found the skills channel at 16.0% attack success in file mode, with hidden Unicode in files peaking at 25.5%.

Three independent papers, three different failure modes, one conclusion: per-package scanning is the wrong unit of analysis.

We solved a version of this in package management with lockfiles, transitive dependency scanning, and signatures. The skills ecosystem has per-package scanning and nothing else. No lockfile equivalent that pins the set of skills available to an agent, no dependency graph analysis over composition, no runtime observation of the chain actually taken.

What you can do now: pin your installed skill set explicitly rather than resolving it dynamically, cap chain depth if your harness supports it, and log which skills an agent actually invoked per task so you have a chain trace when something goes wrong. That last one is the cheapest and nobody does it.

One honest note on the Tencent paper: their rule-based and LLM judges disagree materially, with the LLM judge assigning partial compliance 7.3% of the time versus 2.0% for the rule-based one. Injection benchmark numbers are softer than they look, and that's true across this whole subfield.