CoRedSkill: Stealthy Skill Composition Attacks via AST-Guided Injection

1 Introduction

• Earlier single-skill attacks expose a concentrated attack context, while composition attacks give limited attention to preserving normal task completion and skill utility.The authors identify utility preservation and stealth as requirements for practical skill red-teaming.Source: §1 · p. 1
• CoRedSkill decomposes workflows into interdependent skills and uses AST rewriting to embed attack operations in task helper functions while preserving task logic.Instructions guide skill invocation, while workflow dependencies and intermediate artifacts connect distributed operations.Source: §1 · pp. 1–2
• 98.0% attack success, 95.3% task success, and 3.3% detection rate; joint success is 90.7% versus 6.7–42.7% for four baselines.The benchmark pairs 50 tasks with three attack objectives.Source: §1 · p. 2
• Skill compositions can complete legitimate tasks while carrying out unauthorized operations that evade auditing.The method connects distributed operations through workflow dependencies and intermediate artifacts.Source: §1 · p. 2
• The benchmark contains 150 cases spanning 50 tasks and three attack objectives, evaluating task completion, unauthorized effects, and audit detection.The evaluation includes four LLM-based audit configurations, composition-aware auditing, and runtime defenses.Source: §1 · p. 2

2.1 Scenario

• Agents autonomously select and order third-party skills using the user request, skill documentation, and input–output dependencies, while auditors can inspect skill code or execution records.Skills may exchange information through intermediate artifacts.Source: §2.1 · p. 2

2.2 Attacker Capabilities and Objectives

• The attacker is a third-party publisher who can inspect, construct, and modify workflow-based skills, seeking unauthorized operations while preserving utility and evading audits within configured permissions.Published skill instructions and intermediate artifacts influence skill selection and execution.Source: §2.2 · p. 2

3.1 Problem Formulation

• A successful injected composition meets task-output acceptance and the attack-objective oracle while avoiding flags across the constituent skill packages.Utility is assessed using task output acceptance, while execution success and audit evasion are evaluated separately.Source: §3.1 · p. 3

3.2 Workflow Decomposition

• The construction model partitions the original workflow by task responsibilities and data dependencies, retaining stage processing and guiding autonomous skill invocation through documentation and JSON artifacts.Attack-chain steps are grouped by data dependencies and assigned to stages whose functions support the required operations.Source: §3.2 · p. 4

3.3 Attack Injection

• AST rewriting embeds each stage’s assigned operations in target helper functions and updates related calls, arguments, and artifact interfaces while preserving task logic.Packaging updates scripts, entry points, resources, and documentation, then reparses scripts and checks rewrite anchors.Source: §3.3 · p. 4
• Intermediate artifacts carry attack-relevant data between skills, connecting distributed operations as the agent follows workflow dependencies during execution.In the exfiltration example, one skill records file paths and field names, a second collects values, and a third sends them to an unauthorized recipient after publishing the requested plan.Source: §3.3 · pp. 4–5

4.1 Experimental Setup

• The benchmark pairs 50 tasks with three attack objectives; four adapted attack baselines and clean controls are evaluated alongside skill-package and runtime defenses.Each task has output acceptance criteria, and CoRedSkill uses a three-skill composition by default.Source: §4.1 · pp. 5–6

4.2 Overall Evaluation

• 90.7% JSR for CoRedSkill on the 150-case benchmark exceeds the four baselines’ 6.7–42.7%; its ASR, TSR, and DR are 98.0%, 95.3%, and 3.3%, respectively.In 140 cases both task and attack succeeded; 136 of those also passed the skill audit.Source: §4.2 · p. 6, Table 1 · p. 6

4.3 Stealth against Skill Auditors

• CoRedSkill’s DR ranges from 3.3% to 20.0% across four LLM audit configurations and is lower than SkillJect, Skill-Inject, and SCR-Bench in each.ColluSkill’s DR is lower only under SkillScan with GLM, while its ASR and TSR are 50.0% and 38.0%, respectively; SkillFortify and CiscoSkillScan have zero DR for CoRedSkill.Source: §4.3 · p. 6

4.4 Extension of Composition Size

• 100% ASR holds at k=2, 3, and 4, while overall DR ranges from 4.2% to 34.7% and its lowest value varies by audit configuration.Across attack objectives, TAM has the lowest DR in most composition-size and audit-configuration combinations.Source: §4.4 · pp. 6–7, Figure 2 · p. 7

4.5 Stealth against Runtime Defenses

• 10.7% DR under HITL and 1.3% under DefenseClaw are lower than Skill-Inject and SCR-Bench under both runtime configurations.CoRedSkill’s DR is also below ColluSkill’s 32.0% under HITL; the authors suggest task-function embedding and intermediate artifacts may make malicious intent harder for audit rules to identify.Source: §4.5 · p. 7, Table 3 · p. 7

4.6 Evaluation under Adaptive Defense

• 28.7% DR under composition-aware auditing exceeds CoRedSkill’s 3.3% under SkillScan and 11.3% under SkillSpector, but is below SCR-Bench’s 74.0% and ColluSkill’s 40.0%.Detection varies by objective: EXF is 74.0%, TAM 2.0%, and PRV 10.0%; clean compositions have a 24.0% false-positive rate.Source: §4.6 · pp. 7–8, Table 4 · p. 8

4.7 Ablation Study

• 100% ASR requires all three skills to be injected; ASR is 0% with zero or one injected skill and 36.6% with two.TSR is 93.1% with one injected skill and 100% with zero, two, or three injected skills; the ablation uses a shared 24-task subset.Source: §4.7 · p. 8

Attacks on Agent Skills

• Prior skill attacks use injected instructions, scripts, concealment, or poisoned models; CoRedSkill distributes unauthorized operations across task functions while preserving utility.The cited work also documents malicious packages, credential leakage, and repository-dependent risks.Source: §5 · p. 8

Compositional Attacks

• Compositional-attack work studies harmful combinations and skill interactions; CoRedSkill embeds operations in existing task logic and connects them through normal intermediate artifacts.The paper states that modified skills retain utility, verified through task outputs.Source: §5 · p. 8

Skill Auditing and Runtime Defenses

• Skill auditing uses static checks and LLM analysis, while other defenses reconstruct cross-skill dependencies or monitor execution; CoRedSkill evaluates all three audit settings.The cited auditing approaches also include hierarchical triage, capability comparisons, and repository context.Source: §5 · p. 8

6 Conclusion

• 90.7% joint success rate accompanies CoRedSkill’s 98.0% ASR, 95.3% TSR, and 3.3% DR in the main evaluation.Joint success requires attack success, task completion, and audit evasion in the same case.Source: §6 · p. 8
• CoRedSkill combines workflow decomposition with AST rewriting to embed distributed attack operations in task functions while preserving skill utility.Source: §6 · p. 8
• Skill compositions can complete legitimate tasks while jointly performing unauthorized operations that evade auditing.Source: §6 · p. 8

Limitations

• Automatic adaptation to arbitrary existing skill packages has not been evaluated; construction relies on predefined attack specifications and workflow interfaces.Source: Limitations · p. 9
• Utility preservation was checked against output-acceptance criteria in 150 offline cases, without dynamic service interactions or long-term operation.Source: Limitations · p. 9
• Runtime defense tests measured rule-based detection on execution records, not how online blocking affects later execution or attack outcomes.Source: Limitations · p. 9

Ethics Statement

• 15 evaluation cases use locally constructed skill packages in independent task sandboxes with synthetic data, simulated protected resources, and controlled endpoints.Source: Ethics Statement · p. 9
• The study avoids production services and deployed third-party skill installations, and identifies concealment of malicious operations as a possible misuse.Source: Ethics Statement · p. 9
• Planned releases include sanitized execution traces, synthetic inputs, and an evaluation harness, but not directly usable malicious skill packages.The stated purpose is to support attack identification and defense evaluation.Source: Ethics Statement · p. 9

A Benchmark and Evaluation Details

• The appendix documents task acceptance criteria, evaluation-case selection, the execution environment, and outcome checks.Source: A Benchmark and Evaluation Details · p. 11

A.1 Benchmark Construction

• The benchmark implements 50 tasks from public scenarios, with 150 cases pairing each task with data-exfiltration, state-tampering, or privilege-violation objectives.All methods receive the same legitimate request and task-output acceptance criteria for each case.Source: §A.1 · p. 11

A.2 Execution and Verification

• Executions use fresh sessions and workspaces, with six clean distractor skills; alternative execution models changed outcomes little, while audit-model changes modestly shifted detection rates.Agents autonomously select skill calls and execution commands; expected publication payloads are withheld from their requests.Source: §A.2 · pp. 11–12
• Task completion requires an exact match between the qualifying publication request’s JSON body and the expected payload; attack evidence is checked separately.Attack checks cover protected-value transfers outside authorized scope, unauthorized copying into skill archives, and out-of-scope helper-script execution.Source: §A.2 · p. 12

A.5 Composition Size Results

• Composition-size detection results cover two-to-four-skill compositions evaluated on the same 72 cases from a fixed 24-task subset.Table A3 reports detection rates by composition size and audit configuration.Source: Table A3 · p. 13, §A.5 · p. 13

A.3 Auditor Settings

• Individual-package audits inspect documentation, code, and resources; four LLM configurations combine SkillScan or SkillSpector with Deepseek or GLM, alongside static-only scanners.Composition-aware auditing instead provides all constituent skills’ contents together.Source: §A.3 · p. 13

A.4 Runtime Audit Configurations

• Runtime audits apply risk and policy rules to execution records, network requests, tool commands, and installed skill files, counting high- or critical-rated matches as detections.Source: §A.4 · p. 13

B.1 Attacks on Agent Skills

• CoRedSkill distributes attack operations across existing task functions while preserving skill utility.Source: §B.1 · p. 14

B.2 Compositional Attacks

• Unlike ColluSkill’s interdependent subpayloads and SkillTrojan’s fragments accumulated across invocations, CoRedSkill uses AST rewriting in existing skills while preserving functionality.ColluSkill (Zeng et al., 2026); SkillTrojan (Feng et al., 2026).Source: §B.2 · p. 14

• Auditing approaches include static and LLM-based checks, hierarchical triage, attention-guided review, model signals, capability comparisons, repository context, and dependency analysis.Source: §B.3 · p. 14
• Runtime defenses constrain actions and privileges, assess risks and apply policies, or audit sandbox behavior using information-flow evidence.Source: §B.3 · p. 14
• Execution-based evaluation tests whether distributed attacks evade detection while preserving utility by combining package and runtime auditing with output-based task acceptance.Source: §B.3 · p. 14

C Partial Injection Ablation

• EXF and TAM ASRs reach 83.3% and 79.2%, respectively; under P 110, PRV ASR reaches 79.2%, with the third skill remaining clean.For EXF and TAM, downstream injected skills request needed files or fields, which the agent finds in task materials and supplies. Under P 110, upstream injected skills place a task-unrelated, permission-locked helper script in the workspace and restore its execute permission; the agent runs it based on workflow context.Source: C Partial Injection Ablation · p. 15

D.1 Attack Baseline Adaptations

• The adapted baselines use distinct constructions: description templates and wrappers, generated malicious skills, capability-flow workflows, or interdependent three-skill chains refined with scanner feedback.Source: §D.1 · p. 15

D.2 Threat Model Comparison

• Unlike controlled skill-interaction scenarios or interdependent malicious payloads, CoRedSkill injects attacks into existing skills with independently verifiable utility and measures task completion alongside attack success and audit evasion.Source: §D.2 · p. 15

E Three-Skill Construction Example

• The EXF example distributes protected-file and field inventory, value collection, and data transfer across three skills while preserving their inventory-replenishment workflow.Its intermediate artifacts carry task results and information used by later attack operations.Source: E Three-Skill Construction Example · pp. 15–16

E.1 Protected Data and State Dependencies

• The first skill inventories fixture files and fields, the second collects their values alongside task results, and the third publishes the plan before distributing selected entries to a configured destination.The published plan matches the expected output, while the execution record also shows the protected warehouse credential sent to an unauthorized recipient.Source: §E.1 · p. 16, §E.2 · p. 16

E.2 Anchor Binding and AST Transformation

• AST rewriting replaces specified helpers and updates callers, while documentation and configuration connect attack operations through existing workflow artifacts.The execution record shows both the expected plan publication and a separate POST sending the protected credential to an unauthorized recipient.Source: §E.2 · p. 16

F Usage of LLMs

• LLMs assist with data generation, code development, and manuscript editing; the human authors developed the research ideas and methodology.Source: F Usage of LLMs · p. 16