ColluSkill: Adversarial Cross-Skill Composition for Evading Agent Skill Scanners

TL;DR - An arXiv cs.CR paper showing that LLM agent "skill" scanners, which inspect skills one at a time, can be evaded by splitting a malicious intent across several individually benign-looking skills that only become harmful when composed at execution time. It matters because agent skill marketplaces are becoming a real attack surface and current defenses have a structural blind spot.

• ColluSkill decomposes a malicious goal into interdependent sub-payloads packaged as separate skills; the attack emerges from ordered composition via contextual dependencies, artifact passing, and execution handoffs rather than any single bad skill.
• It uses LLM-based chain planning plus scanner-feedback refinement to keep chain-level attack semantics while suppressing suspicious signals in each individual sub-skill.
• Against six representative skill scanners, ColluSkill reports a 96.0% average attack success rate, outperforming single-skill and prior multi-skill baselines.
• The proposed defense, ChainGuard, scans a candidate skill jointly with already-installed skills — reconstructing cross-skill dependencies, artifact flows, and capability composition — cutting ASR to 22.5% while passing 99.5% of benign workflows.