Search papers, labs, and topics across Lattice.
This paper investigates the vulnerabilities in LLM-based agent systems by introducing ColluSkill, a framework that exploits cross-skill composition to evade existing skill scanners. The study reveals that current defenses inadequately address the risks posed by the interaction of multiple skills, allowing harmful workflows to emerge from seemingly benign individual skills. Through empirical testing, ColluSkill achieves a remarkable 96.0% attack success rate, while the proposed defense mechanism, ChainGuard, effectively reduces this rate to 22.5% without compromising the integrity of benign workflows.
ColluSkill reveals that seemingly harmless skill combinations can orchestrate devastating attacks, achieving a staggering 96% success rate against current defenses.
Agent skills are emerging as an important attack surface in LLM-based agent systems. Through an empirical study of existing skill scanners, we find that current defenses mainly inspect individual skills, leaving risks from cross-skill composition insufficiently examined. This creates a practical blind spot: multiple locally plausible skills may pass security checks while collectively forming a harmful workflow during agent execution. To investigate this threat, we propose ColluSkill, a collusive multi-skill-chain attack framework that decomposes a complete malicious intent into interdependent sub-payloads embedded in independently packaged skills. The attack does not rely on any single malicious skill, but emerges from the ordered composition of locally plausible behaviors through contextual dependencies, artifact passing, and execution handoffs. ColluSkill further employs LLM-based chain planning and scanner-feedback refinement to preserve chain-level attack semantics while reducing suspicious signals in individual sub-skills. To defend against such attacks, we propose ChainGuard, a context-aware skill-chain scanner that jointly analyzes a candidate skill and the skills already installed in the agent environment. ChainGuard reconstructs cross-skill dependencies, artifact flows, capability compositions, and downstream behaviors to identify risks that emerge only at the workflow level. Experiments on six representative skill scanners show that ColluSkill achieves an average attack success rate of 96.0% and consistently outperforms the evaluated single-skill and multi-skill attack baselines. Meanwhile, ChainGuard reduces the attack success rate to 22.5% while allowing 99.5% of benign workflows to pass, highlighting the importance of chain-level security analysis for agent skill ecosystems.
