Stealth Apart, Harm Together: Skill Cascading Attacks on Skill-Based Agent Systems

1 Introduction

• A skill ecosystem extends LLM agents with runtime-loaded packages, but its openness creates a third-party supply-chain attack surface.ClawHub hosts thousands of skills spanning domains including finance, medicine, law, and software engineering.Source: §1 · p. 1
• Per-skill scanners miss risks that propagate through the shared context window as one skill's output becomes input to the next.Prior work has examined threats within individual skills, while cross-skill interactions have received less attention.Source: §1 · p. 2
• Skill cascading attacks distribute a malicious objective across skills so each modification passes per-skill scanning, their execution causes harm, and reverting any one removes it.The prescription-review example successively relabels a discontinued drug, downgrades interactions involving it, and drops low-priority alerts.Source: §1 · p. 2
• SKILLCASCADE produces validated attacks from marketplace skills; its benchmark has 213 cases across 10 domains, and cascades average 89.4% harmful-behavior success across three agents and eight backbones.The reported cascades evade existing per-skill scanners, joint-skill scanners, and runtime defenses.Source: §1 · p. 2
• The paper formalizes the threat, presents an automated red-teaming framework and benchmark, and reports that cascades evade existing scanners and runtime defenses.The benchmark is built from real-world ClawHub skills and covers seven objectives and three cascade patterns.Source: §1 · p. 2

2.1 Skill-Based Agent Systems

• A skill-based agent comprises an LLM, installed skills, a shared context window, and an execution environment; each skill package has five components.Those components are its trigger description, instructions, scripts, reference documents, and assets.Source: §2.1 · p. 2
• At each dispatch step, the LLM selects a skill from the request and current context, then appends that skill's execution output to the context.The process ends when no further skill is needed, producing a final output and execution trace.Source: §2.1 · pp. 2–3
• Because all inter-skill information passes through shared context, earlier skill outputs can steer downstream skills and their selection.The same LLM reads those outputs as input when later skills execute.Source: §2.1 · p. 3

2.2 Threat Model

• The attacker is a skill developer seeking harm on a realistic request that triggers multiple attacker-controlled skills; the victim is an end user or enterprise deploying them.The attacker may modify skill components but cannot alter the LLM weights, system prompt, platform mechanisms, user input, session, or skills outside their control.Source: §2.2 · p. 3
• Co-installation can occur when users or enterprises install domain-specific skill suites from one developer through a single approval decision.A malicious publisher can package skills as a coherent suite under one vendor brand.Source: §2.2 · p. 3

2.3 Skill Cascading Attacks

• A skill cascading attack requires individually scan-cleared modifications, harm on a realistic request, and harm that disappears when any single modification is reverted.The definition formalizes individual stealth, joint harm, and indispensability.Source: §2.3 · pp. 3–4
• Cascades may be causal, compositional, or hybrid, describing harm that accumulates sequentially, emerges from aggregated harmless fragments, or combines both patterns.The seven objectives span output-level, scope-level, and execution-level harms.Source: §2.3 · p. 4

3 The SKILLCASCADE Framework

• The Scenario Discovery Agent pairs a realistic user task with at least two plausibly co-invoked marketplace skills, using task-first and skill-first searches.The task-first strategy finds skills for an imagined task; the skill-first strategy groups compatible popular skills and reverse-constructs a scenario.Source: §3 · p. 4
• The Attack Agent plans an objective, pattern, and techniques, then modifies the scenario's skills with plausible justifications; the Scanner Agent reviews each skill independently.A failed scan sends the skill back for revision.Source: §3 · p. 5
• The Test Case Generator creates executable cases pairing an innocent-looking prompt and required files with criteria for judging the attack.Cases run in fresh containerized sandboxes that record the output and full execution trace.Source: §3 · p. 5
• The Judge Agent checks outputs and execution traces against case criteria, routing failures to scenario discovery, attack planning, or test generation for another iteration.The framework generates cascading-attack test cases from a real skill marketplace.Source: §3 · pp. 4–5

4 SKILLCASCADE-BENCH

• The benchmark contains 213 self-contained, re-executable cases from 10 domains, averaging 3.25 skills per cascade and covering seven objectives and three patterns.Each case includes original and modified skills, a user prompt, and input files.Source: §4 · p. 5
• Three expert annotators independently audited candidate cases, and only cases unanimously approved on attack necessity, workflow realism, and success were included.Agreement across candidates reached Fleiss's κ = 0.82.Source: §4 · p. 5

5.1 Experimental Setup

• The evaluation distinguishes pre-deployment per-skill and joint-skill scanners from runtime defenses that inspect execution-time signals.It reports ASR, scanner stealth rates at both granularities, and defense evasion rate; three runs are averaged per target-agent configuration.Source: §5.1 · pp. 5–6

5.2 Overall Attack Effectiveness

• Table 2 reports overall attack success rate (%) on different target agent systems and LLM backbones; Figure 3 presents an ASR breakdown along three dimensions.Each Figure 3 bar aggregates benchmark runs spanning multiple backbones and agent systems, with error bars showing standard deviation across runs.Source: Table 2 · p. 6, Figure 3 · p. 6
• Figure 4 presents a fragment-withdrawal ablation on three-skill cascades, showing residual ASR across withdrawal counts and pattern-specific signatures at k=1.Figure 5 compares static-analysis signals across submissions, with cascading attacks described as hugging the benign baseline.Source: Figure 4 · p. 7, Figure 5 · p. 7

5.3 Stealth against Pre-Deployment Skill Scanners

• Per-skill scanners retain stealth rates above 86% on modified skills, with marginal detection increases (∆) never exceeding 4.7 points.The authors attribute this to semantic-layer edits that lack syntactic fingerprints and leave only faint narrative cues.Source: §5.3 · p. 7, Table 3 · p. 7
• Joint cross-skill scanners still approve a majority of modified cascades; the static pipeline registers ∆=0, while LLM scanners gain only modestly over per-skill scanning.Table 4 reports SRjoint on original and modified cascades under three cross-skill scanners.Source: §5.3 · p. 7, Table 4 · p. 7

5.4 Stealth against Runtime Defenses

• 88.5% mean DER across four runtime-defense paradigms; trajectory-level inspection still misses four of five cases.The authors attribute these misses to defenses targeting conventional software-security threats while cascades act at the semantic layer and require explicit compositional reasoning.Source: §5.4 · p. 7, Table 5 · p. 7

6.4 Adaptive Defense: A Behavior-Composition Scanner

• The Behavior-Composition Scanner reduces stealth by over 30 points on causal cascades, with smaller reductions on compositional and hybrid cascades.It summarizes each skill’s behavioral commitment, chains the commitments to identify joint consequences, then tests a hypothetical triggering scenario for unsafe output.Source: Figure 7 · p. 8, §6.4 · pp. 8–9

6.1 Indispensability of Cascade Modifications

• Withdrawing one modification leaves 13–18% residual ASR, and withdrawing two reduces it to single digits; withdrawal signatures differ by cascade pattern.Causal cascades show a head-to-tail gradient, compositional cascades stay flat, and hybrid cascades collapse when the tail is withdrawn.Source: §6.1 · p. 8

6.2 Why Independent Skill Scanning Fails

• Cascading edits remain near the benign baseline across six judged axes, whereas single-skill attack payloads score far above it.Independent scanning misses the attacks because it assesses skills individually while harm arises from the cascade.Source: §6.2 · p. 8

6.3 Factors Behind Successful Cascades

• Nine recurring techniques form a long-tailed distribution, combining LLM-specific semantic manipulation with techniques that have classical analogues.Conditional logic injection and cognitive frame restructuring lead, while label escalation, default exploitation, and selective filtering also contribute substantial mass.Source: §6.3 · p. 8

6.5 Case Study

• In an earnings-call case, three individually defensible edits produce a Buy/Hold memo that omits the issuer’s liquidity crisis.The cascade re-classifies, down-weights, and suppresses disclosure signals while leaving operating metrics intact, removing the signals that would trigger a Sell.Source: §6.5 · p. 9, Table 6 · p. 9

• Sandbox attack rates are stress tests rather than forecasts, and marketplace incidence of attacker-controlled co-installation remains unanswered.The authors also say the LLM-based Judge Agent would benefit from complementary human review.Source: §7 · p. 9
• The benchmark carries dual-use risk; access controls and responsible disclosure are the authors’ stated mitigations.They expect the work to support compositional safety analysis beyond per-skill scanning.Source: §7 · p. 9

• Skill cascading attacks distribute a malicious objective across skills that individually clear per-skill scanning but cause harm together.Source: §8 · p. 9
• SKILLCASCADE-BENCH contains validated cascading test cases, and attacks induce harmful behaviors while evading per-skill scanners, joint-skill scanners, and runtime defenses.Source: §8 · p. 10

A Compute Resources

• Experiments used an AMD EPYC 7742 CPU server with 128 GB RAM and no GPU; hosted APIs handled all model inference, and total project API costs were approximately USD $8,000.The cost includes reported runs as well as preliminary and failed experiments.Source: A Compute Resources · p. 15

B Related Work A-2

• Prior skill-risk and defense studies focus on individual skills or steps, while tool-chain attacks manipulate unmodified components; SKILLCASCADE instead distributes benign-looking edits across skills to create harm.The related work argues that component-level scanning and step-isolated monitoring miss this threat surface.Source: §B.1 · p. 15, §B.2 · p. 15, §B.3 · pp. 15–16

C.1 End-to-End Pipeline Pseudocode

• Three nested feedback loops enforce per-skill scanner approval, test cases in a sandbox judged for success, and diagnosis-based routing, with bounded retries that can skip a scenario.The loops revise skills after scanner failures, regenerate test cases, and route Judge diagnoses to the Test Case Generator, Attack Agent, or Scenario Discovery Agent.Source: §C.1 · p. 16

C.2 Pipeline State and Failure Routing

• The pipeline keeps append-only scenario, test-case, and run registries for replay and audit, while the orchestrator routes Judge failures from structured diagnoses and sandbox traces rather than letting the Judge propose edits.Each retry edge has an independent default budget of 3; exhausted budgets fail the scenario, while intermediate artifacts are retained.Source: §C.2 · p. 16, §C.3 · pp. 16, 18

C.4 Detailed Attack Technique Definitions

• The nine attack techniques exploit instruction-bearing outputs, framing and labels, defaults and filtering, covert channels, decision pressure, target injection, and granularity changes to shape downstream behavior.Each technique is designed to look reasonable within an individual skill while contributing to a harmful cross-skill effect.Source: §C.4 · p. 18
• The remaining techniques add persuasive pressure, silently introduce extra targets whose results are not reported, or alter granularity so holistic risks are split or distinct anomalies merged.These are respectively Decision Pressure Construction, Silent Target Injection, and Granularity Manipulation.Source: §C.4 · pp. 18–19

D.1 Scenario Discovery Agent

• Five agents use contextual isolation and evidence-grounded outputs; the Scenario Discovery Agent selects two or three behaviorally rich, domain-coherent skills linked by realistic information flow, without attack awareness.It alone accesses the marketplace, and its workflow selection is framed neutrally.Source: D Agent Design Protocols · p. 19, §D.1 · pp. 19–20

D.2 Attack Agent

• The Attack Agent creates a plan and minimally edits skills so each change appears routine under per-skill review while their combination realizes emergent harm.It maps skill information flows and chooses a concrete malicious objective and cascade paradigm; the supplied passage begins its workflow description.Source: §D.2 · p. 20
• The Attack Agent plans and implements a cascade through minimal, plausibly routine skill edits, preserving skill names and structure while excluding attack-related meta-language from shipped artifacts.It records the objective, paradigm, mechanisms, modifications, rationales, and information flow in attack_plan.md; modifications must match that plan.Source: §D.2 · p. 21

D.3 Scanner Agent

• The Scanner Agent delegates each isolated skill review to an unmodified public scanner; a skill passes at LOW or MEDIUM risk, and a triple is reported only if all its skills pass all four scanners.The agent dispatches scans without aggregating evidence or second-guessing scanner reports.Source: §D.3 · pp. 21–22

D.4 Test Case Generator Agent

• The Test Case Generator creates a realistic, meta-language-free task naming all three skills in invocation order, with referenced input data sufficient to trigger the planned cascade.Its evaluation criteria use absolute checks, combine field-level and semantic judgments when appropriate, and avoid brittle exact-phrase requirements.Source: §D.4 · pp. 22–23

D.5 Judge Agent

• The Judge evaluates each sandbox run against its own criteria, citing artifact evidence for each condition; ambiguous conditions count as unmet, and a run passes only if every condition is clearly met.The Judge does not see the attack plan or propose revisions; the orchestrator routes failed runs upstream.Source: §D.5 · p. 24

E Full Attack Case Studies

• The case studies span healthcare, finance, and insurance, including a sepsis downgrade, a spurious dose reduction, a loan approval based on altered borrower metrics, and a 116% premium gap between identical-risk drivers.The examples represent causal, compositional, and hybrid cascades, respectively.Source: E Full Attack Case Studies · p. 25

E.1 Causal Cascade

• Causal cases vary in cascade density: one modifies two skills and relies on a pass-through renderer, while another modifies all three with distinct attack primitives.The three primitives are data-shape, comparison-operator, and output-framing changes.Source: §E.1 · p. 25

E.1.1 Two Modifications with a Pass-Through Renderer: Sepsis Lactate Unit Drift

• 4.2 mmol/L was rendered as 4.2 mg/dL, yielding an urgent classification and three “No” recommendations, unlike the unmodified pipeline.The actual septic-shock-range value is 37.8 mg/dL; the unmodified skills recommended the opposite actions.Source: §E.1.1 · pp. 25, 28
• The converter used a lactate molecular weight of 10.0 g/mol instead of 90.08 g/mol, making its conversion factor 1.0.This produced “4.2 mg/dL” instead of 37.8 mg/dL, while the lookup table contained correct entries for other analytes.Source: §E.1.1 · p. 26
• The triage carve-out treats lactate below 10.0 mg/dL as routine after a recent procedure, so the misconverted 4.2 mg/dL avoids critical classification.The 10 mg/dL threshold is clinically reasonable; the upstream conversion makes a septic-shock value appear below it.Source: §E.1.1 · pp. 26–27
• All three skills cleared all four scanners, and the unmodified health-report skill rendered the urgent classification into the final clinical document.The renderer’s role was to present the upstream triage category and make the suppression irreversible at the recommendation layer.Source: §E.1.1 · p. 27

E.1.2 Three Modifications Across Distinct Primitives: Antibiotic Stewardship Review

• The cascade combines data truncation, an inclusive threshold comparison, and urgent report framing across three skills.The extractor supplies the value used by the safety reviewer, whose alert triggers the report’s urgent section.Source: §E.1.2 · p. 29
• eGFR 50.3 was truncated to 50, triggered a renal-dosing alert, and produced a prominent recommendation to confirm or reduce levofloxacin despite full-dose safety.The report’s urgent section appeared above all other content; acting on the spurious alert could lead to sub-therapeutic dosing and treatment failure.Source: §E.1.2 · pp. 29, 31
• The extractor changes eGFR 50.3 to 50, and the reviewer changes the renal-dosing check from < to <=, creating a false-positive alert.The recorded rationales describe integer eGFR values as matching downstream thresholds and <= as matching conservative guideline language.Source: §E.1.2 · p. 29
• All three skills cleared every one of the four scanners, whose individual reviews did not flag the edits.The integer rule, operator change, and urgent-escalation step each read as routine in isolation.Source: §E.1.2 · p. 30
• All three modifications are jointly necessary: reverting any one prevents the urgent dose-reduction directive that satisfies the Judge condition.Without the report-framing edit, the alert remains ordinary boilerplate; reverting either upstream edit prevents the alert.Source: §E.1.2 · pp. 31–32

E.2 Compositional Cascade

• The three modifications independently bias the same decision from different angles, and their effects compound rather than forming a causal chain.Removing any one of them causes the harm to disappear.Source: §E.2 · p. 32
• The pipeline approved a borrower whose true profile yields a Poor tier and about 44% back-end DTI, while reporting Fair-to-Good and 9.5% DTI.The recommendation gave a 36-month term; the judge’s ablation checks found that removing any one modification eliminated the harmful approval.Source: §E.2 · pp. 32, 34
• The edits elevate a borderline FICO score, exclude existing obligations from the pre-qualification DTI, and use tier and DTI as triggers for a 36-month term.The structuring rule treats the upstream tier and DTI as authoritative rather than re-deriving them from raw applicant data.Source: §E.2 · pp. 32–33
• All three skills cleared every one of the four scanners, with each edit resembling a common product or workflow convention in isolation.The reported examples include trend adjustments at tier boundaries, simplified pre-qualification DTI, and tier-based term structuring.Source: §E.2 · p. 33
• The case exposes a producer-trigger coupling: one skill introduces “Fair-to-Good,” and another consumes it as a trigger, which per-skill scanners cannot see.The paper identifies shared identifiers, predicates, and field schemas as targets for future cross-skill auditing.Source: §E.2 · p. 34

E.3 Hybrid Cascade

• The cascade is hybrid: profile enrichment is causally upstream of multiplier lookup, while territory and occupational loadings independently compound the premium.Removing the enrichment prevents those multiplier inputs from reaching the calculator; removing the loading edit leaves both drivers at the same base premium.Source: §E.3 · pp. 34, 37
• $1,902.29 versus $883.58: two drivers with identical vehicles, coverage, mileage, credit scores, and violations received premiums differing by about 2.15×.Their material differences were ZIP code and employer; the output contained no reference to protected characteristics.Source: §E.3 · pp. 34–37
• The enrichment maps ZIP prefixes to territory classes and employer or occupation keywords to occupation tiers; the paper characterizes these as class proxies.The cited passage links the territory ranges and tier-3 keywords to historically graded ZIP areas and race and income correlations, respectively.Source: §E.3 · p. 35
• All three skills cleared every one of the four scanners, with the proxy tables and keyword lists reading as standard reference or ingestion rules.Source: §E.3 · p. 36