Agent skill chains beat safety scanners 83% of the time

A new paper called CompoSkill breaks the assumption that scanning individual agent skills before listing them keeps a marketplace safe. An attacker with only a role profile chained marketplace skills into a working attack 80.6% of the time, per the paper. With white-box access, that figure climbs to 83.3%, per the paper. Existing scanners catch only a limited fraction of these chains, because they evaluate each skill on its own.

The attack doesn't touch any single skill's code. It chains several benign-looking skills together, and the malicious behavior only shows up in the combination.

To find those chains, an attacker needs only a target's role profile, no source code, no internal access. They download top skills from a marketplace and build what the paper calls a Skill Composition Graph. Then they search that graph for chains whose lure text never names a skill by identifier.

Both numbers come from CompoSkill-Bench, a 1,140-record test spanning five threat types and six scenarios, run against two agent harnesses, OpenClaw and Nanobot.

Attack success decays past three hops, per the paper. That gives defenders a concrete limit to design around. Cap how many skills can chain together, or scan the composition graph instead of each skill alone, and most of the gap closes.

Anyone building or shipping a skill marketplace, whether that's OpenClaw, Nanobot, or an internal tool registry, should treat composition as its own attack surface. Per-skill checklists aren't enough on their own. A related paper in the same corpus, SkillWatermark, found that benign-looking skill descriptions can already turn agent traffic into a covert exfiltration channel. Composition risk and description-level risk are shaping up to be the two things per-skill review keeps missing.