ColluSkill: Adversarial Cross-Skill Composition for Evading Agent Skill Scanners

Jingzhi Li; Ju Jia; Puyu Zeng; Simeng Qin; Xiaojun Jia; Zheli Liu

REVIEW 4 major objections 5 minor 30 references

ColluSkill: Adversarial Cross-Skill Composition for Evading Agent Skill Scanners

T0 review · 4 major / 5 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Splitting a malicious intent across three innocuous-looking agent skills bypasses current skill scanners 96% of the time.

desk verdict The cross-skill composition threat is real and the paper demonstrates it against six current scanners, but the 96% ASR is an upper bound because the attack is tuned and tested on the same scanners. read the letter →

arxiv 2608.09732 v1 pith:R7YH2FTU submitted 2026-08-10 cs.CR cs.AI

Puyu Zeng , Simeng Qin , Jingzhi Li , Ju Jia , Zheli Liu , Xiaojun Jia This is my paper · ORCID

classification cs.CRcs.AI

keywords agentskillsLLMagentsskillscannersmulti-skillcompositionchain-levelattackadversarialevasionsecurityscanning

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Agent skills are becoming an installable extension mechanism for LLM agents, and this paper argues that the security scanners built to vet them inspect the wrong unit. The claim is that a single harmful intent can be decomposed into sub-skills that each look locally plausible but recover the full attack when executed in order, and the paper demonstrates this with ColluSkill, a chain-planning and scanner-feedback refinement attack that evades six representative skill scanners on 96.0% of test chains. The paper also claims the blind spot is fixable: ChainGuard, which scans a candidate skill together with skills already installed in the agent environment, cuts the attack success rate to 22.5% while still passing 99.5% of benign workflows. If the reported numbers hold, skill-ecosystem security should shift from single-skill inspection to workflow-level analysis.

What carries the argument

The central object is the interdependence chain, a conceptual three-role structure $C_{\mathrm{concept}}=(Z,E)$ with $Z=\{z_1,z_2,z_3\}$ and $E=\{(z_1\to z_2),(z_2\to z_3)\}$, instantiated as three ordered sub-payloads connected by artifact passing, context references, and execution handoffs. This object makes the scanner view ($\max_i D(s_i)=0$) and the workflow view ($R_{\mathrm{chain}}(W)\ge\tau_{\mathrm{risk}}$) diverge, which is exactly the gap the attack exploits. The second load-bearing mechanism is scanner-feedback refinement: at each iteration only flagged sub-skills are rewritten from compressed scanner output, so local suspicious signals shrink while chain-level semantics are preserved. On the defense side, the equivalent mechanism is ChainGuard's candidate-centered dependency path, reconstructed by comparing a candidate skill against all installed skills in both producer and consumer directions and checking whether their composition forms a complete harmful workflow.

What would settle it

Take chains generated by ColluSkill after refinement on the six scanners, freeze them, and run them against a held-out seventh scanner or an updated version of one of the six; if the average attack success rate collapses toward the 36.7% naive-split level, the headline result is an artifact of feedback-loop overfitting rather than generalizable evasion.

Watch

Extended reading notes

Core claim

ColluSkill's central claim is that the risk of a malicious agent workflow can be relocated from any single skill to the ordered relation between skills, and that current scanners cannot follow it there. Given an original payload $p$, an attacker LLM first infers an ordered payload plan $(p_1,p_2,p_3)$ and then a skill plan, writing each sub-payload into its own SKILL.md file $s_i$. The chain is defined as $C_{\mathrm{inst}}=(\{p_1,p_2,p_3\},\{(p_1\to p_2),(p_2\to p_3)\})$, so later sub-payloads consume artifacts or context produced by earlier ones. ColluSkill submits each sub-skill to the target scanner set; if any scanner flags $s_i^{(t)}$, the attacker LLM rewrites only that sub-skill using compressed scanner feedback, so $\max_i D(s_i)=0$ while the composed workflow still carries chain-level risk $R_{\mathrm{chain}}(W)\ge\tau_{\mathrm{risk}}$. The paper reports that this yields a 96.0% average attack success rate across six scanners, with chain planning alone contributing 68.2% and scanner-feedback refinement the rest, and that the resulting chains activate successfully on three coding agents. The paired defense claim is that a context-aware scanner reconstructing candidate-centered dependencies and capability-splitting relations against the installed-skill context reduces the attack success rate to 22.5% while admitting 99.5% of benign workflows.

Load-bearing premise

The load-bearing premise is that the attacker can keep submitting sub-skills to the exact six scanners and read their binary flags, so the reported 96.0% success rate is evasion of those specific scanners under iterative feedback rather than proof of generalizable stealth.

Editorial extensions

If this is right

Single-skill scanners cannot cover agent-skill security: any risk that exists only in ordered composition passes through them.
Chain planning is what makes evasion reliable: naive payload splitting reaches only 36.7% average attack success, ordered chain planning reaches 68.2%, and scanner-feedback refinement lifts it to 96.0%.
Installation-time defense is viable: blocking any one sub-skill of a chain prevents the workflow, and context-aware scanning keeps benign workflow pass rates at 99.5%.
The attack executes on real coding agents, with chain activation success between 58.5% and 92.5% across agents and model backbones, so the blind spot is practical, not just a scanner artifact.
Even under the proposed defense, 22.5% of attack chains still pass, so multi-skill composition remains an unsolved problem.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The 96.0% figure measures evasion of the six queried scanners under iterative feedback; a held-out test against updated or unqueried scanners would show how much of the success is feedback-loop overfitting versus intrinsic stealth.
Because the refinement loop consumes only binary flags, defenders could poison the oracle by randomizing, rate-limiting, or watermarking scanner verdicts, making the rewrite signal unreliable.
ChainGuard reconstructs installation-time dependency paths; extending it to temporal and concurrent execution ordering could catch interleaved chains that never exist as a contiguous installation sequence.
The 3-step optimum suggests an arms race over chain length and context budgets, potentially pushing attackers toward stateful or cross-session composition that no single installation context contains.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

ColluSkill/ChainGuard is a solid, well-scoped attack paper. The threat it targets—malicious intent split across multiple skill files that pass individual scans but compose into a harmful workflow—is real, and the paper demonstrates it convincingly against six currently deployed scanners. The new piece is the combination of LLM-based chain planning with iterative scanner-feedback refinement; the ablation in Table 3 cleanly shows that naive splitting alone gets only 36.7%, ordered planning brings it to 68.2%, and refinement to 96.0%. The runtime activation numbers on three coding agents add useful evidence that the chain actually executes.

The main soft spot is the evaluation protocol, and it matches the stress-test concern. The attack queries the same six scanners to rewrite flagged sub-skills, then reports success against those same scanners. That is a legitimate black-box threat model, but it means the 96% is a measure of success against five specific static detectors, not a generalizable property of "skill scanners" as a class. There is no held-out scanner, no scanner-update simulation, and no transferability test. The broader claim that existing defenses have a cross-skill blind spot is supported only for this fixed set. A defender who watermarks queries, rate-limits the refinement loop, or simply updates the scanner could break the attack. The authors should be asked for held-out scanner evaluation and at least one adaptive-defense simulation.

ChainGuard's evaluation is thin in a different way: it is only compared to itself without installed-skill context (Table 4), and the 22.5% residual ASR is not benchmarked against any other defense. That is acceptable for a first demonstration, but the defense claim is weaker than the attack claim. The post hoc selection of chain length (3) and refinement budget (7 iterations) from the same evaluation curves in Figure 3 is another reason to treat the headline as an upper bound. Also, the appendices and code are not in the manuscript, so reproducibility cannot be checked.

None of this undermines the central result: the attack works on six real scanners, and the chain-level threat is credible. The paper cites prior work (SCRBench) and honestly positions itself as an extension. I would send it to review, asking for the missing transferability analysis, defense baselines, and code or a clear reproducibility appendix.

Referee Report

4 major / 5 minor

Summary. This paper studies cross-skill composition as an attack surface for LLM agent skill scanners. The authors propose ColluSkill, which decomposes a malicious payload into three ordered, interdependent sub-payloads packaged as separate skills, uses LLM-based chain planning to preserve chain-level semantics, and then iteratively rewrites sub-skills that are flagged by a set of target scanners. They evaluate ColluSkill against six skill scanners, reporting an average attack success rate of 96.0%, and show chain activation on OpenCode, Claude Code, and Codex. They also propose ChainGuard, a context-aware scanner that jointly analyzes a candidate skill with installed skills; it reduces ColluSkill's ASR to 22.5% while passing 99.5% of benign workflows. The central claims are that existing scanners have a practical blind spot for cross-skill composition and that ChainGuard closes much of that gap.

Significance. Cross-skill composition is a timely and plausible threat: the attack idea is well-motivated by the modular skill ecosystem, the framework is concrete, and the runtime activation study goes beyond pure scanner evasion. The use of interdependence chains and artifact passing is a useful conceptual framing, and the ablation separating naive split, chain planning, and scanner-feedback refinement is informative. ChainGuard's candidate-with-context design is a reasonable defense direction, and the benign-workflow pass rate is a welcome check. However, the headline 96.0% ASR is currently a measure of overfitting to the exact six scanners used as refinement oracles, and the defense numbers come from the same team without an adaptive adversary. If the evaluation is reworked with held-out scanners and proper uncertainty quantification, the framework could be an important contribution; in its present form the empirical support for the generalizable-blind-spot claim is not yet sufficient.

major comments (4)

[Refine with scanner feedback; Table 1] The evaluation protocol is circular in a way that is load-bearing for the headline result. In the 'Refine with scanner feedback' paragraph, every flagged sub-skill is rewritten until it passes 'the target scanner set D', and Table 1 then reports the attack success rate against that same set D. ColluSkill is therefore optimized directly on the exact six detectors used for evaluation, and the 96.0% average ASR (Table 1, last row) is best interpreted as an upper bound for an adversary with unlimited queries to those specific scanner instances, not as evidence of a generalizable cross-skill blind spot. The paper needs a held-out scanner evaluation (e.g., scanners or scanner versions not used during refinement), an adaptive-defender baseline, and a query-budget sensitivity analysis; without these, the contribution of scanner-feedback refinement shown in Table 3 (from 68.2% to 96.0%) cannot be separated from overfitting.
[Effect of LLM refinement iterations; Figure 3; Effect of the number of sub-skills] Hyperparameters are selected post hoc from the same evaluation curves used to report performance. The 3-step chain is chosen 'because it achieves the highest final average ASR' (subsection 'Effect of the number of sub-skills'), and the reported 7-iteration budget is described after observing that the curve 'becomes much flatter' after iteration 5 (subsection 'Effect of LLM refinement iterations'). Selecting the chain length and stopping iteration on the test set inflates the reported 96.0% and can bias the comparison against baselines that were not tuned with scanner feedback. Please use a validation split or nested selection procedure and report the selected configuration's performance on a held-out test set.
[Experimental Setup; Tables 1 and 2] No uncertainty quantification is reported for any of the central point estimates. Tables 1, 2, 3, and 4 report single runs without confidence intervals, standard deviations, or significance tests, even though both the attack generation and the four LLM-based scanners use GPT-5.5 and are therefore stochastic. Claims such as 'consistently outperforms' (Table 1 discussion) and the chain-length ranking in Figure 3 require repeated trials or a statistical test before they can be accepted at face value.
[ChainGuard Defense Evaluation; Table 4] The defense evaluation is not yet convincing as evidence of a practical defense. ChainGuard is proposed and evaluated by the same team, and the reported 22.5% ASR is obtained against a fixed set of ColluSkill chains that were optimized against the six third-party scanners, not against ChainGuard. There is no adaptive attacker that can observe ChainGuard's context-based decisions and rewrite chains, and there is no sensitivity analysis of ChainGuard's dependency-inference thresholds. Without such an analysis, the drop from 69.0% to 22.5% in Table 4 may reflect a specific design match rather than a robust property of context-aware scanning.

minor comments (5)

[Implementation details] Appendices A and B are referenced in 'Implementation details' but are not included in the submitted manuscript; please include them or remove the reference.
[Figure 1] Figure 1 contains the typo 'Payload-decompostion'; also the diagram labels 'iterative refinement' three times without indicating the loop's termination condition.
[Abstract and Introduction] The abstract and introduction state that the authors conducted 'an empirical study of existing skill scanners' that found the individual-inspection blind spot, but no methods or results for that study are reported; either add a subsection or cite a prior study.
[In-chain Attack Generation] The attacker LLM is denoted Gθ but θ is never defined, and the sentence 'the program writes its body into a separate SKILL.md file' is ambiguous about who writes the file.
[Throughout] The term 'CISCO Skill Scanner' should be 'Cisco Skill Scanner' to match the reference list, and scanner names such as 'SkillSpector' should be checked for consistent capitalization.

Circularity Check

1 steps flagged · score 6.0 of 10

The 96.0% average ASR is measured on the same six scanners used as the refinement oracle, so the headline is in part fitted to the test set rather than an independent evaluation.

fitted input called prediction [Method, 'Refine with scanner feedback'; Experiments, 'Scanners and metrics' and Table 1]
"At each iteration, every sub-skill is submitted to the target scanner set D. If s_i^(t) is flagged by any scanner, ColluSkill compresses the scanner output into a short rewrite feedback z_i^(t) and uses the attacker LLM to rewrite this sub-skill as s_i^(t+1)=G_refine(s_i^(t), p_i, z_i^(t)). ... The loop stops when all sub-skills pass the target scanners or when the maximum number of iterations is reached. ... An attack is counted as successful only when all three sub-skills pass the scanner."

The refinement loop's stopping criterion is the same as the ASR measurement criterion: every sub-skill must pass the target scanner set D. Since ColluSkill is rewritten against exactly those six scanners and Table 1 reports ASR on the same six scanners, the 96.0% result largely records whether the query-based optimizer found a satisfying rewrite, not whether cross-skill composition generalizes to unseen scanners. The paper provides no held-out scanner set, so the headline number is a fitted test-set result rather than an independent measure of scanner blind spots. The ablation makes the contribution of this fitting explicit: chain planning alone reaches 68.2%, and scanner-feedback refinement contributes the remaining ~28 points on the same scanners.

full rationale

The central quantitative claim is partially circular: ColluSkill's scanner-feedback refinement uses the six target scanners as an oracle, and the attack success rate is then measured by whether the refined sub-skills pass those same scanners. The stopping condition 'all sub-skills pass the target scanners' makes success on the evaluation set a fitted outcome. However, the paper also contains independent content: chain planning without scanner feedback reaches 68.2% ASR, and runtime activation on three coding agents shows that the composed chains execute, so the work is not entirely reducible to the circular step. The ChainGuard defense is evaluated only against ColluSkill, which limits generalization claims but is not a circular derivation because ChainGuard's detection rule is not defined in terms of the attack's success. No load-bearing self-citation or imported uniqueness theorem was found; references to the authors' prior work (e.g., SkillJect) are used as baselines, not as justification for the central claim. Overall score 6 reflects the partial reduction of the headline result to the refinement procedure.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

The core experimental claims rest on the availability of a scanner-feedback oracle, the representativeness of six named scanners and GPT-5.5, the assumption that agent runtimes execute the skills in the planned order, and post hoc choices of chain length and refinement budget. These are not derived from first principles and are not all independently validated.

free parameters (4)

Chain length (number of sub-skills) = 3
Selected as default after comparing 2-, 3-, and 4-step chains in Figure 3; the 3-step setting achieved the highest final ASR (96.0%), so the choice is tuned on the evaluation data.
Maximum refinement iterations = 7
The reported average ASR of 96.0% corresponds to iteration 7; Figure 3 shows the curve flattens after iteration 5, and the stopping point is chosen to maximize the headline result.
Attack payload dataset size = 200
The dataset of 200 malicious payloads is constructed by the authors without external standardization, and the resulting ASR variance is not reported.
Evaluated scanner set = CISCO, SkillFortify, Auditor, SlowMist, Vetter, SkillSpector
The six scanners and the shared GPT-5.5 backend define the evaluation surface; no sensitivity analysis over scanner versions or other scanners is provided.

assumptions (4)

domain assumption Existing skill scanners inspect each skill in isolation and do not maintain installed-skill context.
This is the central premise of the attack, stated in the Introduction and formalized in Section 'Scanner view and workflow view' via max_i D(s_i)=0.
domain assumption The agent runtime will activate the three sub-skills in the planned order with artifact passing intact.
Table 2 shows chain activation rates of 58.5% to 92.5%, so this assumption holds only partially; the attack's stated effectiveness depends on runtime cooperation.
domain assumption The six selected scanners and GPT-5.5 are representative of real-world skill defenses.
Generalization of the 96.0% ASR beyond the evaluated set is claimed but not demonstrated; the paper does not justify representativeness.
ad hoc to paper LLM chain planning preserves the original malicious semantics across sub-payloads.
The decomposition-reconstruction step (Section 'Infer the payload plan') is not formally guaranteed; chain-level semantics are only inferred from downstream ASR.

how reviews work

0 comments

Cite this review

Pith. "Pith review of ColluSkill: Adversarial Cross-Skill Composition for Evading Agent Skill Scanners." pith.science (2026). https://pith.science/paper/R7YH2FTU

@misc{pith2026260809732,
  author       = {Pith},
  title        = {Pith review of: ColluSkill: Adversarial Cross-Skill Composition for Evading Agent Skill Scanners},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/R7YH2FTU}},
  note         = {Machine review of arXiv:2608.09732}
}

read the original abstract

Agent skills are emerging as an important attack surface in LLM-based agent systems. Through an empirical study of existing skill scanners, we find that current defenses mainly inspect individual skills, leaving risks from cross-skill composition insufficiently examined. This creates a practical blind spot: multiple locally plausible skills may pass security checks while collectively forming a harmful workflow during agent execution. To investigate this threat, we propose ColluSkill, a collusive multi-skill-chain attack framework that decomposes a complete malicious intent into interdependent sub-payloads embedded in independently packaged skills. The attack does not rely on any single malicious skill, but emerges from the ordered composition of locally plausible behaviors through contextual dependencies, artifact passing, and execution handoffs. ColluSkill further employs LLM-based chain planning and scanner-feedback refinement to preserve chain-level attack semantics while reducing suspicious signals in individual sub-skills. To defend against such attacks, we propose ChainGuard, a context-aware skill-chain scanner that jointly analyzes a candidate skill and the skills already installed in the agent environment. ChainGuard reconstructs cross-skill dependencies, artifact flows, capability compositions, and downstream behaviors to identify risks that emerge only at the workflow level. Experiments on six representative skill scanners show that ColluSkill achieves an average attack success rate of 96.0% and consistently outperforms the evaluated single-skill and multi-skill attack baselines. Meanwhile, ChainGuard reduces the attack success rate to 22.5% while allowing 99.5% of benign workflows to pass, highlighting the importance of chain-level security analysis for agent skill ecosystems.

Figures

Figures reproduced from arXiv: 2608.09732 by the authors.

**Figure 1.** Overview of the cross-skill composition blind spot. Existing scanners primarily inspect individual skills, while runtime [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗

**Figure 2.** Overview of ChainGuard. ChainGuard scans a candidate skill together with the full installed-skill context. It reconstructs [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗

**Figure 3.** Effect of chain length under LLM refinement. We [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

30 extracted references · 9 canonical work pages

[2]

https://github.com/cisco-ai-defense/skill- scanner

Skill Scanner: Security Scanner for Agent Skills. https://github.com/cisco-ai-defense/skill- scanner. Accessed: 2026-06-25, V2.0.1. Du, S.; Zhao, J.; Shi, J.; Xie, Z.; Jiang, X.; Bai, Y.; and He, L

work page 2026
[3]

Elias, N

A survey on the optimization of large language model-basedagents.ACM Computing Surveys,58(9):1–37. Elias, N. 1978.What is sociology?Columbia University Press. fedrov.2025.SkillVetter1.0.0—ClawHub.https://clawhub. ai/fedrov2025/skill-vetter-1-0-0. Accessed: 2026-06-25. Feng, Y.; Ding, Y.; Tan, Y.; Zheng, B.; Guo, Y.; Li, X.; Zhai, K.; Li, Y.; and Huang, W

work page 1978
[4]

Guo, W.; Zeng, W.; Liu, C.; Jia, X.; Xu, Y.; Tang, L.; Fang, Y.; and Liu, Y

Skilltrojan: Back- door attacks on skill-based agent systems.arXiv preprint arXiv:2604.06811. Guo, W.; Zeng, W.; Liu, C.; Jia, X.; Xu, Y.; Tang, L.; Fang, Y.; and Liu, Y. 2026a. MalSkillBench: A Runtime-Verified Benchmark of Malicious Agent Skills.arXiv preprint arXiv:2606.07131. Guo, Z.; Chen, Z.; Nie, X.; Lin, J.; Zhou, Y.; and Zhang, W. 2026b. SkillPro...

arXiv
[5]

Holzbauer, F.; Schmidt, D.; Gegenhuber, G.; Schrittwieser, S.;andUllrich,J.2026

POISE: Position-Aware Undetectable Skill InjectiononLLMAgents.arXiv preprint arXiv:2606.07943. Holzbauer, F.; Schmidt, D.; Gegenhuber, G.; Schrittwieser, S.;andUllrich,J.2026. ContextMatters:Repository-Aware Security Analysis of the Agent Skill Ecosystem.arXiv preprint arXiv:2603.16572. Hou,Y.;andYang,Z.2026. Skillsieve:Ahierarchicaltriage framework for d...

arXiv 2026
[6]

InInternational Conference on Learning Representations, volume 2026, 70802–70832

Obscure but effective: Classical chi- nese jailbreak prompt optimization via bio-inspired search. InInternational Conference on Learning Representations, volume 2026, 70802–70832. Ji, Z.; Xu, C.; Li, Z.; Gao, Y.; Wei, X.; Wang, S.; and Che- ung, S.-C

work page 2026
[7]

Jia, X.; Liao, J.; Qin, S.; Gu, J.; Ren, W.; Cao, X.; Liu, Y.; and Torr, P

Cloak and Detonate: Scanner Evasion and Dynamic Detection of Agent Skill Malware.arXiv preprint arXiv:2607.02357. Jia, X.; Liao, J.; Qin, S.; Gu, J.; Ren, W.; Cao, X.; Liu, Y.; and Torr, P. 2026a. Skillject: Automating stealthy skill- based prompt injection for coding agents with trace-driven closed-looprefinement. InThe 6th Workshop of Adversarial Machin...

arXiv
[9]

Li, H.; Mu, C.; Chen, J.; Ren, S.; Cui, Z.; Zhang, Y.; Bai, L.;andHu,S.2026a

SkillMutator: Benchmarking and Defending Language-and-Code Cross- modal Attacks on LLM Agent Skills.arXiv preprint arXiv:2606.14154. Li, H.; Mu, C.; Chen, J.; Ren, S.; Cui, Z.; Zhang, Y.; Bai, L.;andHu,S.2026a. Organizing,Orchestrating,andBench- markingAgentSkillsatEcosystemScale.arXiv:2603.02176. Li, X

arXiv
[10]

Li, X.; Chen, W.; Liu, Y.; Zheng, S.; Chen, X.; He, Y.; Li, Y.; You, B.; Shen, H.; Sun, J.; et al

When single-agent with skills replace multi-agent systems and when they fail.arXiv preprint arXiv:2601.04748. Li, X.; Chen, W.; Liu, Y.; Zheng, S.; Chen, X.; He, Y.; Li, Y.; You, B.; Shen, H.; Sun, J.; et al. 2026b. SkillsBench: Benchmarking how well agent skills work across diverse tasks.arXiv preprint arXiv:2602.12670. Li, Z.; Wu, J.; Ling, X.; Cui, X.;...

arXiv 2026

Show all 30 references

[11]

Liu, B.; Li, X.; Zhang, J.; Wang, J.; He, T.; Hong, S.; Liu, H.; Zhang, S.; Song, K.; Zhu, K.; et al

Agent skills: A data-driven analysis of claude skills for extending large lan- guagemodelfunctionality.arXiv preprint arXiv:2602.08004. Liu, B.; Li, X.; Zhang, J.; Wang, J.; He, T.; Hong, S.; Liu, H.; Zhang, S.; Song, K.; Zhu, K.; et al
[13]

https://openai.com/ index/gpt-5-5-system-card/

GPT-5.5 System Card. https://openai.com/ index/gpt-5-5-system-card/. Accessed: 2026-07-11. Pu, H.; Song, X.; and Zhao, L

2026
[14]

Qu, Y.; Liu, Y.; Geng, T.; Deng, G.; Li, Y.; Zhang, L

SkillOps: Managing LLM Agent Skill Libraries as Self-Maintaining Software Ecosystems.arXiv preprint arXiv:2605.13716. Qu, Y.; Liu, Y.; Geng, T.; Deng, G.; Li, Y.; Zhang, L. Y.; Zhang,Y.;andMa,L.2026. Supply-chainpoisoningattacks against LLM coding agent skill ecosystems.arXiv ...

2026 arXiv
[15]

Virus- Total Blog

From Automation to Infection: How OpenClaw AI Agent Skills Are Being Weaponized. Virus- Total Blog. Accessed: 2026-06-25. Ruan, Y.; Dong, H.; Wang, A.; Pitis, S.; Zhou, Y.; Ba, J.; Dubois, Y.; Maddison, C.; and Hashimoto, T

2026
[16]

InInternational Conference on Learning Representations, volume 2024, 27031–27098

Identi- fying the risks of lm agents with an lm-emulated sandbox. InInternational Conference on Learning Representations, volume 2024, 27031–27098. Saha, S.; and Hemanth, P

2024
[17]

Schmotz, D.; Abdelnabi, S.; and Andriushchenko, M

Skilldex: A Package Man- agerandRegistryforAgentSkillPackageswithHierarchical Scope-BasedDistribution.arXiv preprint arXiv:2604.16911. Schmotz, D.; Abdelnabi, S.; and Andriushchenko, M

arXiv
[18]

Schmotz, D.; Beurer-Kellner, L.; Abdelnabi, S.; and An- driushchenko, M

Agent Skills Enable a New Class of Realistic and Trivially SimplePromptInjections.arXiv preprint arXiv:2510.26328. Schmotz, D.; Beurer-Kellner, L.; Abdelnabi, S.; and An- driushchenko, M
[19]

SlowMist

Skill-inject: Measuring agent vulnerability to skill file attacks.arXiv preprint arXiv:2602.20156. SlowMist

arXiv
[20]

https://github.com/snyk/ agent-scan

Agent Scan: Security Scanner for AI Agents, MCP Servers and Agent Skills. https://github.com/snyk/ agent-scan. Accessed: 2026-06-25. Tie, G.; Shi, J.; Zhou, P.; and Sun, L

2026
[21]

arXiv preprint arXiv:2604.09378

Badskill: Back- door attacks on agent skills via model-in-skill poisoning. arXiv preprint arXiv:2604.09378. Wang, C.; Yu, Z.; Xie, X.; Yao, W.; Fang, R.; Qiao, S.; Cao, K.; Zheng, G.; Qi, X.; Zhang, P.; et al

arXiv
[22]

arXiv preprint arXiv:2604.04804

Skillx: Automaticallyconstructingskillknowledgebasesforagents. arXiv preprint arXiv:2604.04804. Wang, G.; Xie, Y.; Jiang, Y.; Mandlekar, A.; Xiao, C.; Zhu, Y.; Fan, L.; and Anandkumar, A

arXiv
[24]

Xu, A.; Lin, B.; Xue, B.; Wang, B.; Xu, B.; Wu, B.; Zhang, B.; Lin, C.; Dong, C.; Ling, C.; et al

Be- nigninIsolation,HarmfulinComposition:SecurityRisksin Agent Skill Ecosystems.arXiv preprint arXiv:2606.15242. Xu, A.; Lin, B.; Xue, B.; Wang, B.; Xu, B.; Wu, B.; Zhang, B.; Lin, C.; Dong, C.; Ling, C.; et al
[25]

arXiv preprint arXiv:2606.19348

Deepseek-v4: Towards highly efficient million-token context intelligence. arXiv preprint arXiv:2606.19348. Xu, R.; and Yan, Y
[26]

Yao,S.;Zhao,J.;Yu,D.;Du,N.;Shafran,I.;Narasimhan,K.; and Cao, Y

Agent skills for large language models: Architecture, acquisition, security, and the path for- ward.arXiv preprint arXiv:2602.12430. Yao,S.;Zhao,J.;Yu,D.;Du,N.;Shafran,I.;Narasimhan,K.; and Cao, Y

arXiv
[28]

Uncovering security threats and architecting defenses in autonomous agents: A case study of openclaw.arXiv preprint arXiv:2603.12644. Z.ai
[29]

https: //z.ai/blog/glm-5.2

GLM-5.2: Built for Long-Horizon Tasks. https: //z.ai/blog/glm-5.2. Accessed: 2026-07-17. Zheng, B.; Fatemi, M. Y.; Jin, X.; Wang, Z. Z.; Gandhi, A.; Song, Y.; Gu, Y.; Srinivasa, J.; Liu, G.; Neubig, G.; et al

2026
[30]

Zhou,Y.;Shu,W.;Su,Y.;Du,W.;Fang,Y.;andLin,X.2026

Skillweaver: Web agents can self-improve by discov- ering and honing skills.arXiv preprint arXiv:2504.07079. Zhou,Y.;Shu,W.;Su,Y.;Du,W.;Fang,Y.;andLin,X.2026. A comprehensive survey on agent skills: Taxonomy, tech- niques, and applications.arXiv preprint arXiv:2605.07358

2026 arXiv
[2022]

Ying, Z.; Yang, X.; Wu, S.; Song, Y.; Qu, Y.; Li, H.; Li, T.; Wang, J.; Liu, A.; and Liu, X

React: Synergizing reasoning and acting in language models.arXiv preprint arXiv:2210.03629. Ying, Z.; Yang, X.; Wu, S.; Song, Y.; Qu, Y.; Li, H.; Li, T.; Wang, J.; Liu, A.; and Liu, X

arXiv
[2023]

Wang, L.; Ma, C.; Feng, X.; Zhang, Z.; Yang, H.; Zhang, J.; Chen,Z.;Tang,J.;Chen,X.;Lin,Y.;etal.2024

Voyager: An open- ended embodied agent with large language models.arXiv preprint arXiv:2305.16291. Wang, L.; Ma, C.; Feng, X.; Zhang, Z.; Yang, H.; Zhang, J.; Chen,Z.;Tang,J.;Chen,X.;Lin,Y.;etal.2024. Asurveyon large language model based autonomous agents.Frontiers of Computer...

2024 arXiv
[2024]

Jiang,Y.;Li,D.;Deng,H.;Ma,B.;Wang,X.;Wang,Q.;and Yu,G.2026

Improved techniques for optimization- basedjailbreakingonlargelanguagemodels.arXiv preprint arXiv:2405.21018. Jiang,Y.;Li,D.;Deng,H.;Ma,B.;Wang,X.;Wang,Q.;and Yu,G.2026. SoK:AgenticSkills–BeyondToolUseinLLM Agents.arXiv preprint arXiv:2602.20867. Jin, C.; Wang, A.; Wei, Z.; Wa...

2026 arXiv
[2025]

arXiv preprint arXiv:2504.01990

Advances and challenges in foundation agents: From brain-inspired intelligence to evolutionary, collaborative, and safe systems. arXiv preprint arXiv:2504.01990. Liu, Y.; Chen, Z.; Zhang, Y.; Deng, G.; Li, Y.; Ning, J.; Zhang, Y.; and Zhang, L. Y. 2026a. Malicious agent skills...

2026 arXiv
[2026]

arXiv preprint arXiv:2605.28588

Technical Report: Ex- ploring the Emerging Threats of the Agent Skill Ecosystem. arXiv preprint arXiv:2605.28588. Bhardwaj,V.P.2026.Formalanalysisandsupplychainsecu- rity for agentic AI skills.arXiv preprint arXiv:2603.00195. Cisco AI Defense

2026 arXiv

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.

[1] [2]

https://github.com/cisco-ai-defense/skill- scanner

Skill Scanner: Security Scanner for Agent Skills. https://github.com/cisco-ai-defense/skill- scanner. Accessed: 2026-06-25, V2.0.1. Du, S.; Zhao, J.; Shi, J.; Xie, Z.; Jiang, X.; Bai, Y.; and He, L

work page 2026

[2] [3]

Elias, N

A survey on the optimization of large language model-basedagents.ACM Computing Surveys,58(9):1–37. Elias, N. 1978.What is sociology?Columbia University Press. fedrov.2025.SkillVetter1.0.0—ClawHub.https://clawhub. ai/fedrov2025/skill-vetter-1-0-0. Accessed: 2026-06-25. Feng, Y.; Ding, Y.; Tan, Y.; Zheng, B.; Guo, Y.; Li, X.; Zhai, K.; Li, Y.; and Huang, W

work page 1978

[3] [4]

Guo, W.; Zeng, W.; Liu, C.; Jia, X.; Xu, Y.; Tang, L.; Fang, Y.; and Liu, Y

Skilltrojan: Back- door attacks on skill-based agent systems.arXiv preprint arXiv:2604.06811. Guo, W.; Zeng, W.; Liu, C.; Jia, X.; Xu, Y.; Tang, L.; Fang, Y.; and Liu, Y. 2026a. MalSkillBench: A Runtime-Verified Benchmark of Malicious Agent Skills.arXiv preprint arXiv:2606.07131. Guo, Z.; Chen, Z.; Nie, X.; Lin, J.; Zhou, Y.; and Zhang, W. 2026b. SkillPro...

arXiv

[4] [5]

Holzbauer, F.; Schmidt, D.; Gegenhuber, G.; Schrittwieser, S.;andUllrich,J.2026

POISE: Position-Aware Undetectable Skill InjectiononLLMAgents.arXiv preprint arXiv:2606.07943. Holzbauer, F.; Schmidt, D.; Gegenhuber, G.; Schrittwieser, S.;andUllrich,J.2026. ContextMatters:Repository-Aware Security Analysis of the Agent Skill Ecosystem.arXiv preprint arXiv:2603.16572. Hou,Y.;andYang,Z.2026. Skillsieve:Ahierarchicaltriage framework for d...

arXiv 2026

[5] [6]

InInternational Conference on Learning Representations, volume 2026, 70802–70832

Obscure but effective: Classical chi- nese jailbreak prompt optimization via bio-inspired search. InInternational Conference on Learning Representations, volume 2026, 70802–70832. Ji, Z.; Xu, C.; Li, Z.; Gao, Y.; Wei, X.; Wang, S.; and Che- ung, S.-C

work page 2026

[6] [7]

Jia, X.; Liao, J.; Qin, S.; Gu, J.; Ren, W.; Cao, X.; Liu, Y.; and Torr, P

Cloak and Detonate: Scanner Evasion and Dynamic Detection of Agent Skill Malware.arXiv preprint arXiv:2607.02357. Jia, X.; Liao, J.; Qin, S.; Gu, J.; Ren, W.; Cao, X.; Liu, Y.; and Torr, P. 2026a. Skillject: Automating stealthy skill- based prompt injection for coding agents with trace-driven closed-looprefinement. InThe 6th Workshop of Adversarial Machin...

arXiv

[7] [9]

Li, H.; Mu, C.; Chen, J.; Ren, S.; Cui, Z.; Zhang, Y.; Bai, L.;andHu,S.2026a

SkillMutator: Benchmarking and Defending Language-and-Code Cross- modal Attacks on LLM Agent Skills.arXiv preprint arXiv:2606.14154. Li, H.; Mu, C.; Chen, J.; Ren, S.; Cui, Z.; Zhang, Y.; Bai, L.;andHu,S.2026a. Organizing,Orchestrating,andBench- markingAgentSkillsatEcosystemScale.arXiv:2603.02176. Li, X

arXiv

[8] [10]

Li, X.; Chen, W.; Liu, Y.; Zheng, S.; Chen, X.; He, Y.; Li, Y.; You, B.; Shen, H.; Sun, J.; et al

When single-agent with skills replace multi-agent systems and when they fail.arXiv preprint arXiv:2601.04748. Li, X.; Chen, W.; Liu, Y.; Zheng, S.; Chen, X.; He, Y.; Li, Y.; You, B.; Shen, H.; Sun, J.; et al. 2026b. SkillsBench: Benchmarking how well agent skills work across diverse tasks.arXiv preprint arXiv:2602.12670. Li, Z.; Wu, J.; Ling, X.; Cui, X.;...

arXiv 2026