Search papers, labs, and topics across Lattice.
This paper introduces CompoSkill, a framework that reveals vulnerabilities in the certification of autonomous AI agent skills by demonstrating how individually certified skills can lead to risky compositions when combined. The authors conducted experiments using both white-box and black-box attackers to assess the effectiveness of skill composition attacks, achieving Chain Formation Rates of up to 83.3% and 80.6%, respectively. The findings highlight a critical oversight in current skill scanning methods, which fail to account for the emergent risks associated with skill interactions, thereby exposing a significant gap in safety protocols for long-horizon tasks.
Skill compositions can exploit safety gaps, with CompoSkill achieving up to 83.3% success in forming risky chains from individually certified skills.
Autonomous AI agents tackling Long Horizon Tasks depend on marketplace skills that are certified one at a time: a scanner returns a safety verdict for each skill and declares the ecosystem safe if every package passes. We show that this assumption fails under skill composition. A skill may pass the per-skill scanner individually yet participate in a risky composition when an agent connects its outputs, capabilities, or side effects with those of other scanner-passing skills. This makes skill composition risk a path level property rather than a node level property, explaining why existing skill scanners that inspect individual packages achieve limited interception. To study this threat, we present CompoSkill, a framework that constructs skill composition attacks through a dual attacker system. The white-box attacker knows the victim's installed skill pool and directly injects explicit skill-id sequences; the black-box attacker knows only a role profile, downloads the top marketplace skills for that scenario, builds a Skill Composition Graph, and searches for high risk chains whose implicit lures never name skill identifiers. We further construct CompoSkill-Bench, a benchmark of 1,140 records built from long-horizon professional workflows across five threats and six scenarios on OpenClaw and Nanobot. CompoSkill achieves risk Chain Formation Rates (CFR) up to 83.3% in the white box setting and 80.6% in the black box setting, while existing skill scanners block only a limited fraction of the risky compositions. Finally, we observe a bridge-bonus-then-hop-decay pattern: a bridge skill can increase attack success, but Attack Success Rate (ASR) decreases once additional hops make the risk chain longer than three skills. These results expose a systematic gap in single skill certification for autonomous AI agents.
