CoRedSkill: Covert agent skill-composition attacks via AST-guided injection

How can agent skill combination attacks covertly evade security audits and jointly trigger unauthorized operations while maintaining normal task utility and functional integrity.

• Skill ecosystem and collaboration scenarios: Agents extend their capabilities by reusing third-party skill packages and chain multiple skills in complex workflows, passing data through intermediate artifacts. The authors note that skill publishers in public skill libraries have varying levels of trust, and untrusted skills may induce agents to perform unauthorized operations beyond the user's authorization scope.
• Limitations of existing attack methods: Single-skill attacks (e.g., Skill-Inject, SkillJect) concentrate all malicious logic in a single package, making them easily detectable by LLM-based code scanners; existing combined attacks (e.g., SCR-Bench, ColluSkill) do not adequately preserve the original task logic, leading to reduced task completion rates, while skill utility is the basis for user adoption and agent invocation.
• Core idea and design: The authors propose decomposing tasks into multiple interdependent skills, embedding attack steps into auxiliary task functions at each stage through abstract syntax tree (AST) rewriting, and chaining dispersed operations via artifact passing and input-output dependencies, completing the attack chain while maintaining normal business logic.
• Threat model:
  • Attacker role and capabilities: The attacker plays a third-party skill publisher, able to inspect original skill documentation and scripts, publish multiple skills and modify their instructions, code, resources, and input/output interfaces.
  • Attack goals: Maintain original skill utility within configured permissions, evade skill package audits and runtime defenses, and induce data exfiltration (EXF), state tampering (TAM), or privilege escalation (PRV).
  • Victim system and constraints: User legitimate requests define the authorization scope; agent deployment determines the underlying model, system prompt, security measures, and file, network, and process permissions.
  • Interaction and trigger method: The attacker influences the agent's autonomous choices and invocation order through published skill descriptions and intermediate artifacts, causing operations dispersed across skills to collaboratively achieve the goal during legitimate task execution.

Empirical study of agent skill security

• Malicious skill ecosystem and supply chain analysis: Liu et al. (2026c,b) and Chen et al. (2026b) analyzed malicious skill packages in the wild and credential leakage phenomena; Li et al. (2026), Jiang et al. (2026), and Holzbauer et al. (2026) explored skill architecture and repository-level supply chain risks.
• Single-skill attack mechanisms: Skill-Inject (Schmotz et al., 2026), SkillJect (Jia et al., 2026), and Poise (Hao et al., 2026) place malicious instructions through prompt injection, execution feedback refinement, or position-aware strategies; Wang et al. (2026b) and Liu et al. (2026a) studied hidden comments and payload-free skill attacks; Chen et al. (2026a) and SkillHarm (Ning et al., 2026) analyzed attacks that dynamically modify skill state.

Combined attack research

• Tool chains and intent fragmentation: STAC (Li et al., 2025) and Semantic Intent Fragmentation (Ahad et al., 2026) study decomposing attack goals into locally compliant subtasks or tool invocation chains.
• Skill interaction risks and paths: SkillReact (Wang et al., 2026c), SkillProbe (Guo et al., 2026b), and SCR-Bench (Xie et al., 2026) evaluate capability flow, trust transfer, and authorization confusion during skill combination.
• Cross-skill payload collaboration: ColluSkill (Zeng et al., 2026) constructs interdependent sub-payloads around malicious goals and optimizes using scanner feedback; SkillTrojan (Feng et al., 2026) accumulates fragments across calls to reconstruct executable payloads. The authors note that these combined attack works focus on constructing attacks and pay less attention to preserving original task logic and completing tasks normally.

Skill audit and runtime defenses

• Static and model-based review of skill packages: SkillScan (Liu et al., 2026c) combines static scanning with LLM review, SkillSpector (NVIDIA, 2026) uses LLMs to review static analysis results; SkillFortify (Bhardwaj, 2026) and CiscoSkillScan (Cisco AI Defense, 2026b) use LLM-free static permission and data flow rule checks; ChainGuard (Zeng et al., 2026) extends audit scope to cross-package dependencies among candidate skills.
• Runtime monitoring and policy constraints: AgentSpec (Wang et al., 2026a) and Progent (Shi et al., 2025) impose permission and behavior constraints; HITL (Shan et al., 2026) monitors execution records through tool invocation rules, and DefenseClaw (Cisco AI Defense, 2026a) applies policy matching to commands, network requests, and skill files.

Baseline methods and evaluation benchmarks

• Comparison baselines include single-skill attacks Skill-Inject (Schmotz et al., 2026) and SkillJect (Jia et al., 2026), as well as combined attacks SCR-Bench (Xie et al., 2026) and ColluSkill (Zeng et al., 2026).
• Evaluation benchmark construction references public task scenarios from Skill-Inject (Schmotz et al., 2026), τ-bench (Yao et al., 2024), and AgentDojo (Debenedetti et al., 2024).

Positioning of this paper: The authors state that, unlike attacks targeting isolated malicious skills or combined attacks that do not preserve task utility, COREDSKILL emphasizes starting from real skills with independently verified utility, using AST rewriting to embed dispersed attack operations within existing task logic, balancing task completion, attack success, and audit evasion.

The authors propose the COREDSKILL framework, which decomposes legitimate workflows into multi-stage interconnected skills and, based on abstract syntax tree (AST) rewriting, covertly weaves the decomposed attack steps into the task functions of each stage, using intermediate data artifacts to connect the dispersed operations.

Problem Setting and Formalization of Objectives

• Skill workflows and execution records: A workflow is defined as a sequence C = (S1, ..., Sk) of k stage skills (k ≥ 2), with each skill exchanging data through intermediate JSON files. The observable execution record produced by the agent running under the environment and user request is τ, containing tool actions, intermediate artifacts, outputs, and environment states.
• Classification of attack objectives: The paper sets the attack objective o at three system levels, including sensitive data exfiltration (EXF, sending protected data to unauthorized endpoints), persistent state tampering (TAM, writing files to the skill archive without authorization to alter persistent state), and privilege escalation (PRV, inducing the agent to execute auxiliary scripts beyond the scope of the user request).
• Definition of the joint objective: Let U(τ) denote task output acceptance, Ao(τ) denote attack determination, and Dρ(C') denote whether any skill in the composition is detected by the audit configuration ρ. The joint objective of attack construction is formalized as: U(τ) = A_o(τ) = 1,   D_ρ(C′) = 0 This formula indicates that the execution record must simultaneously satisfy the task output acceptance criteria and the attack determination condition, and that all component packages evade auditing.

Workflow Decomposition and Attack Chain Mapping

• Division of workflow responsibilities: A construction model M reads the documentation and scripts of the original skill s and splits it into k stage skills C = (S1, ..., Sk) according to task responsibilities and data dependencies. Each stage retains its dedicated business logic and is connected through intermediate artifacts.
• Selection of rewriting anchors: The auxiliary functions in each stage's scripts are analyzed, and functions suitable for accommodating attack operations are selected as rewriting anchors ai (such as file retrieval, field filtering, or data export functions), determining their function names and calling interfaces.
• Step-by-step orchestration of the attack chain: The abstract attack objective o is decomposed into a chain of steps with clear inputs and outputs, grouped by data dependency into ordered operations fi and assigned to the corresponding stages. The stage specification is recorded as Φ(o, k) = (ϕ1, ..., ϕk), with each stage specification containing operation steps, rewriting anchors, replacement templates, and artifact interface conventions.
• Three-stage exfiltration example: Taking three-skill data exfiltration as an example, the first stage is responsible for enumerating and locating the target files, the second stage extracts the target fields and temporarily stores them, and the third stage sends the extracted values to an unauthorized recipient after the business data is published.

Attack Embedding and Packaging Based on AST Rewriting

• Syntax tree replacement and interface synchronization: Parsing tools are used to locate the script where the anchor function resides and generate the abstract syntax tree Gi. According to the stage specification, replacement templates are applied to update the anchor function's logic, while synchronously modifying the relevant callers' parameters and artifact reads and writes: G′_i = 𝒯_AST(G_i; ϕ_i),   S′_i = Pack(S_i, G′_i; ϕ_i) This formula indicates that specified structural replacements are applied to the syntax tree to embed the attack logic, followed by assembly to generate the updated source script and resource entry points.
• Documentation and resource updates: Explanations of the added operations are supplemented in the skill documentation, packaging them as part of the stage's normal functionality and describing the inputs and outputs; the script is then re-parsed to verify that the rewriting anchors are correctly embedded.

Cross-Skill State Passing and Trigger Mechanism

• Data artifact connection: The intermediate artifacts generated at each stage contain both business result data and hidden data needed for the subsequent attack (such as file paths, configuration fields, or permission information). The subsequent skill reads the artifacts along the normal input-output dependency and continues execution.
• Autonomous invocation trigger: Prompts in the skill documentation guide the agent to autonomously trigger the embedded auxiliary operations (for example, an additional data distribution call) after completing the normal business instructions, thereby chaining together the complete attack chain without changing the output of the main business flow.

Experimental Setup

• Models under test: The agent execution backend uses deepseek-v4-flash and runs on the Claude Code CLI (v2.1.92) platform; supplementary experiments test GPT-5.5 and Kimi K2.5 as alternative execution and audit models.
• Benchmark and scale: 50 tasks are built based on Skill-Inject, τ-bench, and AgentDojo, with 3 attack objectives (EXF, TAM, and PRV) set for each task, totaling 150 evaluation use cases.
• Comparison baselines: Includes 4 attack baselines—Skill-Inject, SkillJect, SCR-Bench, and ColluSkill—and introduces original skills and uninjected clean compositions as control groups.
• Evaluation metrics: ASR (attack success rate), TSR (task success rate), DR (audit detection rate), and JSR (joint success rate, defined as the proportion of runs in which the attack succeeds, the task is completed, and the attack is not detected in the same run).
• Review and detection methods: Code auditing uses SkillScan and SkillSpector, powered by Deepseek and GLM-5.2 respectively, with risk ratings of HIGH or CRITICAL counted as detected; static rules use SkillFortify and CiscoSkillScan; runtime defenses use HITL and DefenseClaw rules.
• Run configuration: Each method installs all of its injected skills plus 6 harmless skills as distractors; each test case runs once in an isolated sandbox with no time limit.

Main Results

According to Table 1, the overall performance of the main evaluation is as follows (auditor is SkillScan powered by Deepseek):

Swipe horizontally to read the table

• Overall performance: Across 150 test cases, COREDSKILL achieves 98.0% ASR, 95.3% TSR, and 3.3% DR, with a joint success rate JSR of 90.7%; baseline methods have JSR in the 6.7%–42.7% range (Table 1).
• Balance of effectiveness and stealth: The authors note that SkillJect achieves 96.0% ASR and 100% TSR but has a DR of 55.3%; ColluSkill maintains a low DR of 9.3% but has ASR and TSR of 50.0% and 38.0%, respectively, indicating that it sacrifices attack achievement and task completion to evade auditing.
• Performance by objective: COREDSKILL achieves 100% ASR, 96.0% TSR, and 4.0% DR under EXF; 94.0% ASR, 96.0% TSR, and 0% DR under TAM; and 100% ASR, 94.0% TSR, and 6.0% DR under PRV (Table 1).

Defense Evaluation Against Skill Code Auditors

• LLM audit performance: COREDSKILL's overall DR across 4 LLM audit configurations ranges from 3.3% to 20.0%, lower than SkillJect (55.3%–86.7%), Skill-Inject (84.7%–100%), and SCR-Bench (74.7%–100%) in all configurations (Table 2).
• Backend model impact: When the audit model is replaced with GLM, COREDSKILL's overall DR under SkillScan and SkillSpector is 20.0% and 16.0%, respectively, higher than with the Deepseek backend, but the vast majority of attack cases remain undetected (Table 2).
• Static scanning performance: SkillFortify and CiscoSkillScan, which do not involve LLMs, both show 0% overall DR for COREDSKILL and also 0% for SkillJect (Table A2); original skills and clean compositions have 0% false alarm rates across all static and LLM single-package audit configurations (Table 2, Table A2).

Evaluation Against Runtime Defenses

• Runtime rule detection rate: COREDSKILL has a detection rate of 10.7% under HITL rules and 1.3% under DefenseClaw strict policies, lower than Skill-Inject (50.7% and 66.7%) and SCR-Bench (24.7% and 3.3%) (Table 3).
• Stealth comparison: SkillJect has detection rates of 7.3% and 0.7% under the two runtime defenses, but its DR under package-level LLM auditing is as high as 55.3%–86.7%; ColluSkill has a detection rate of 32.0% under HITL (Table 2, Table 3).
• Mechanism explanation: The authors believe that COREDSKILL embeds attack operations within business functions and connects them through artifacts, intertwining malicious behavior with normal task execution and reducing the probability of triggering runtime behavior rules.

Composition Scale and Adaptive Defense Experiments

• Composition scale expansion: Comparing k = 2, 3, 4 on 24 tasks (72 use cases), ASR remains 100% at all three scales, with overall DR between 4.2% and 34.7% (Figure 2, Table A3). The authors note that the detection rate does not decrease monotonically as the number of skills increases, because spreading the attack across more skills may leave some stages without sufficient normal business logic for cover.
• Composition-aware adaptive auditing: When all component skills are submitted to the audit LLM simultaneously, COREDSKILL's overall DR rises to 28.7% (Table 4). Among these, EXF's DR reaches 74.0%, while TAM and PRV have DRs of only 2.0% and 10.0%; meanwhile, the false alarm rate of clean compositions under this adaptive audit rises to 24.0% (Table 4).

Other Ablations and Analyses

• In a partial-injection ablation on 24 tasks, single-skill injection yields 0% ASR and an average TSR of 93.1%, with the agent deviating from the intended workflow in some cases and attempting alternative approaches, causing task outputs to fail acceptance (Table C1).
• With two-skill injection, the average ASR is 26.4%–54.2% and TSR is 100%; with all three skills injected, both ASR and TSR are 100% (Table C1).
• Under configuration P011, the ASR for EXF and TAM reaches 83.3% and 79.2%, respectively; the authors state that the agent autonomously searches for missing inputs and completes the attack chain (Table C1).
• Under configuration P110, the ASR for PRV reaches 79.2%; the authors state that after the first two stages restore permissions, the agent completes the task in the third stage and autonomously executes the script (Table C1).
• When the execution model is replaced with GPT-5.5 or Kimi K2.5, execution results differ only slightly (Appendix A.2).
• When the audit model is replaced with Kimi K2.5, detection rates change slightly, but the relative performance trends across methods remain consistent (Appendix A.2).

Limitations and Future Directions Noted by the Authors

• Limited automated adaptation capability: Attack construction relies on predefined attack specifications and workflow interfaces, and automated adaptation to arbitrary existing skill packages is not evaluated (Limitations section).
• Limited utility validation scenarios: Skill utility is validated only against output acceptance criteria in 150 offline evaluation cases, and performance under dynamic service interactions or long-running environments is not evaluated (Limitations section).
• Defense evaluation does not include online interception: Runtime defense evaluation uses only offline execution records to measure the detection capability of risk and policy rules, and does not evaluate the impact of online real-time blocking on subsequent agent execution and attack outcomes (Limitations section).
• Responsible release strategy: To reduce misuse risk, the authors plan to open-source sanitized execution traces, synthetic inputs, and the evaluation toolchain, but will not publicly release malicious skill packages that can be directly used for attacks (Ethics Statement section).

Experimental Coverage

• System configuration under test: The agent execution environment is based on the Claude Code CLI (v2.1.92), with the primary backend model deepseek-v4-flash, and GPT-5.5 and Kimi K2.5 additionally tested in the appendix (Section 4.1 and Appendix A.2).
• Benchmark coverage scale: The tests include 50 tasks and 3 types of attack objectives; the main experiment covers 150 offline test cases, and the composition-scale and partial-injection ablation experiments cover 72 use cases across 24 tasks (Section 4.1 and Appendix A.1).
• Audit and defense scope: Package-level auditing tests SkillScan and SkillSpector (powered by Deepseek and GLM-5.2, respectively) and the static scanners SkillFortify and CiscoSkillScan; runtime defense tests HITL and DefenseClaw; adaptive defense tests composition-aware auditing that submits all skills (Sections 4.3, 4.5, 4.6).
• Experiment run mechanism: Each use case runs once in an isolated sandbox with no runtime limit imposed; the test environment includes 6 clean skills as distractors, and environment data uses controlled local simulated services and read-only firmware (Section 4.1 and Appendix A.2).
• Unreported information: The paper does not report the specific time and token consumption of LLM calls during the attack construction phase, nor the specific amount of manual verification work at each stage.

• Paper positioning: The paper proposes the COREDSKILL framework for covert coordinated cross-skill attacks in the agent skill ecosystem, studying how to achieve unauthorized operations and audit evasion while maintaining normal business utility.
• Problem addressed: Existing single-skill attacks concentrate on a single package and are easily intercepted by review, while existing combined attacks often disrupt the original task logic and cause task failure; the paper aims to solve how to decompose attack operations and covertly embed them into interconnected skills while ensuring normal task output acceptance.
• Core method: Complex tasks are decomposed into multi-stage interconnected skills through workflow decomposition, abstract syntax tree (AST) rewriting is used to embed the decomposed attack steps into the auxiliary task functions of each stage, attack context and credentials are passed through intermediate task artifacts, and skill documentation guides the agent to autonomously trigger them in sequence.
• Main experimental results: In a benchmark containing 50 tasks and 150 use cases, COREDSKILL achieves a 98.0% attack success rate and a 95.3% task success rate, a 3.3% detection rate under Deepseek-powered SkillScan auditing, and a joint success rate of 90.7% (baselines only 6.7%–42.7%) (Table 1); under the runtime defense DefenseClaw, the detection rate is 1.3% (Table 3).
• Counterexamples and exceptions: Under composition-aware adaptive auditing that submits all component skills, the detection rate for exfiltration attacks rises to 74.0%, and clean compositions produce a 24.0% false alarm rate (Table 4); in the ablation setting where only a single skill is injected, the agent attempts alternative workflows, reducing the task success rate to 88.9%–95.8% (Table C1).
• Authors' conclusions and implications: The authors state that experiments show third-party skill compositions can execute unauthorized operations while completing normal business and evade single-package auditing and runtime rules, suggesting that defense mechanisms urgently need to shift from isolated code scanning to cross-skill interaction analysis and composition-aware auditing.