Agent skills hide attacks across the workflow
Reviewing CoRedSkill: Stealthy Skill Composition Attacks via AST-Guided Injection · Qichen Zhao, Shengfang Zhai, Qingni Shen et al.
Researchers split a malicious operation across several cooperating agent skills, so each package looks benign on its own but the workflow links them into an attack. The composition exfiltrates credentials, tampers with state, or runs unauthorised scripts while passing per-package audits almost every time.
Here is the trick. You take a malicious operation that any auditor would flag, and you cut it into pieces. Each piece lands in a different reusable skill. On its own, each skill does something plausible and useful. Only when the agent runs them in sequence does the attack assemble itself.
That is the idea behind the research the authors call CoRedSkill. It targets the way modern agents extend themselves: reusable skills that bundle instructions, code, and resources. These are often loaded from third parties and chained into workflows. Agents pick skills and pass intermediate files between them. Those handoffs are where the attacker hides the coordination.
Mechanically, it is clean. The authors take a legitimate workflow and split it into interdependent skills. They decide which stage should carry which part of the attack chain. Each malicious operation goes to a stage whose normal job resembles it. Then they rewrite the helper functions using abstract syntax tree editing. That changes what the code does while leaving the interfaces and visible task logic intact. Documentation and config are tuned so an agent following normal selection rules invokes the right skills in the right order. One skill writes an artifact. The next reads it. The protected value walks out the door.
What makes this work is that per-package auditing never sees the whole. On a benchmark of 150 cases, the attack and the task almost always both succeeded. Per-package audits caught it roughly three times in a hundred. The joint rate, meaning attack worked, task completed, and the audit missed it, was about ninety percent. Four baseline methods managed between seven and forty-three percent. Attacks covered data exfiltration, tampering with installed skill state, and running unauthorised scripts.
The turn is in the ablation. Inject one skill and the attack never fires. Inject two and it works about a third of the time. Inject all three stages and it works every time, yet the task still completes along the way. So the attack lives in the coordination, not in any single file. That is also the clearest guidance here: auditing one package at a time is the wrong unit. Reviewing all constituent skills together raised detection to a little under a third overall. It stayed near useless for state tampering, though.
I find the ablation the most persuasive part of the paper. It shows convincingly that the danger sits in how skills combine. It does not show how often a real attacker could pull this off in a live skill ecosystem, and I suspect that depends heavily on how much the attacker knows about the target workflow.
Limits matter. The attacker needs to publish or modify the skills and know the workflow interfaces. The authors also supply the attack specification by hand rather than deriving it from arbitrary packages. Everything ran in sandboxes with synthetic data, and runtime blocking was not tested. Still, the lesson is plain. If your defence looks at skills one at a time, it can easily be looking in the wrong place.
Further analysis
Problem
This paper studies how reusable agent skills, when composed into multi‑stage workflows, can be co‑opted to perform covert malicious operations while still appearing to fulfil their legitimate tasks. Individual skill auditing can miss harmful intent that is distributed across stages because each package retains plausible utility and local behaviour. Understanding such composition attacks matters because agents commonly load third‑party skills and autonomously select and invoke them, passing intermediate artifacts that can connect distributed operations.
Approach
The authors present CoRedSkill, a compositional red‑teaming method that (1) decomposes a task workflow into multiple interdependent skills, (2) assigns portions of an attack chain to stages whose responsibilities match the required operations, and (3) injects the assigned operations into task helper functions via abstract syntax tree rewriting. Rewrites update function bodies, calls, and artifact reads/writes while preserving interfaces and the original task logic. Documentation and configuration are adapted so an agent following normal selection rules will invoke the injected skills and pass intermediate artifacts that carry attack‑relevant data between stages. The threat model assumes an attacker can publish or modify third‑party skills and that the agent will autonomously assemble and execute the composition under a fixed user request and environment. The authors evaluate on a benchmark of 150 cases built from 50 tasks paired with three attack objectives: data exfiltration, persistent state tampering, and privilege violation. They compare CoRedSkill to four adapted baselines and test multiple LLM‑based and static auditors as well as runtime policy checks.
Key Findings
- High joint success: On the 150‑case benchmark CoRedSkill attains 98.0% attack success rate and 95.3% task success rate with a per‑package audit detection rate of 3.3%, yielding a joint success rate (attack, task completion, audit evasion) of 90.7%.
- Outperforms baselines: The joint success of 90.7% exceeds the 6.7–42.7% range observed for four baseline methods adapted to the same tasks and objectives.
- Robust across auditors: CoRedSkill’s detection rate across four LLM audit configurations ranges from 3.3% to 20.0%; static scanners sometimes fail to flag the injected packages.
- Runtime and composition comparisons: Runtime rule checks detect 10.7% under one rule set and 1.3% under another. Composition‑aware auditing that reviews all constituent skills together raises detection to 28.7% overall but is highly variable by objective (for example data exfiltration detections rose to 74.0% while state tampering remained low at 2.0%).
- Dependence on coordination: Partial‑injection ablation shows attack success is 0% with zero or one injected skill, 36.6% with two injected skills, and 100% when all three stages are injected; task success can remain high even with partial injection.
Limitations
The method relies on predefined attack specifications and known workflow interfaces and has not been evaluated for automatic adaptation to arbitrary existing packages. Experiments ran in controlled sandboxes with synthetic data, simulated services and fixtures; long‑term persistence, dynamic service interactions, and real‑world deployment effects were not tested. Runtime blocking effects were not evaluated. The authors do not release runnable malicious packages.
Implications
Attackers who can publish or modify third‑party skills may distribute covert operations across otherwise legitimate skill code to exfiltrate sensitive values, alter installed skill state, or cause execution of unauthorised scripts while preserving visible task outputs and thereby evade per‑package auditing and some runtime checks. Composition enables attackers to hide coordination in intermediate artifacts and documentation so an agent following normal invocation rules will link the fragments into a working attack, as demonstrated by an example that publishes an authorised plan and subsequently transmits a protected credential to an unauthorised host.
The paper title, authors and abstract
CoRedSkill: Stealthy Skill Composition Attacks via AST-Guided Injection
Agents extend their capabilities through reusable skills that package instructions, executable code, and resources. Composing these skills enables complex task workflows, but their dependencies can also connect malicious operations across skills, making their combined intent difficult to identify through individual-package auditing. We introduce CoRedSkill, a compositional red-teaming method that forms stealthy attacks through cooperating skills while preserving their original utility. CoRedSkill decomposes an existing workflow into interdependent skills and embeds attack operations in task functions through abstract syntax tree (AST) rewriting, with skill instructions guiding the agent to autonomously select and invoke the relevant skills, and workflow dependencies and intermediate artifacts connecting the injected operations during task execution. We construct a benchmark of 150 cases covering 50 tasks and three attack objectives to evaluate attack success, task completion, and audit detection. In the main evaluation, CoRedSkill achieves 98.0% attack success and 95.3% task success with a 3.3% detection rate, and a joint success rate of 90.7% (attack success, task completion, and audit evasion in the same case) compared with 6.7--42.7% for the four baselines. Skill compositions can therefore complete legitimate tasks while carrying out unauthorized operations that evade auditing.
