Stealth Apart, Harm Together: Skill Cascading Attacks on Skill-Based Agent Systems

Zihao Zhu; Siwei Lyu; Adel Bibi; Baoyuan Wu

cs.AISep 24, 2026

Stealth Apart, Harm Together: Skill Cascading Attacks on Skill-Based Agent Systems

Authors: Zihao Zhu, Siwei Lyu, Adel Bibi, Baoyuan Wu

Organizations: The Chinese University of Hong Kong, Shenzhen · University at Buffalo, SUNY · University of Oxford

Abstract

A skill is a modular package of natural-language instructions, executable scripts, and reference resources that an agent can load at runtime to extend its capabilities for a specific task. Skill-based agent systems therefore enable flexible reuse of third-party capabilities, but the openness of this skill ecosystem also opens up a new attack surface. Prior work has focused on vulnerabilities within individual skills, but little attention has been paid to risks that arise from interactions across skills. In this paper, we introduce skill cascading attacks, a threat paradigm in which a malicious objective is distributed across multiple skills so that each modification looks benign in isolation, yet their combined execution is harmful. For instance, in a prescription-review pipeline, the first skill weakens signals of recently discontinued medications in the extracted history, the second downgrades the severity of any drug interaction tied to them, and the third suppresses the resulting low-priority alert in the final summary, so that a severe drug-interaction warning silently disappears before reaching the physician. To systematically study this safety blind spot, we develop SkillCascade, an automated multi-agent red-teaming framework, and release SkillCascade-Bench, a benchmark of 213 validated cascading test cases across multiple agent systems and domains. Across representative agents (e.g., OpenClaw, Claude Code, Codex) and LLM backbones, cascaded interactions reliably induce harmful behaviors while evading existing per-skill scanners and runtime monitors. Our findings highlight a gap between component-level integrity and system-level safety, and call for defenses that reason over cross-skill interactions rather than individual skills in isolation.

Figures & tables

Figure 1: Illustration of skill cascade patterns. Left , causal cascade: harm propagates through an ordered chain where each skill weakens the inherited signal. Right , compositional cascade: harm emerges from aggregation, where each modification is harmless alone. Hybrid is omitted for brevity.

Objective	Description
O1. Output corruption	The output deviates from ground truth yet remains plausible to the user.
O2. Decision manipulation	Correct content is reordered, weighted, or framed to steer a different decision.
O3. Functional denial	The pipeline fails, or returns output too low-quality for the user to act on.
O4. Quality degradation	Output looks complete, but depth, coverage, or granularity is silently reduced.
O5. Scope drift	The agent silently extends its actions to resources beyond the user’s stated target.
O6. Information exfiltration	Sensitive user data is written or transmitted outside its authorized destination.

Table 1: The seven attack objectives of skill cascading attacks.

Figure 2: Overview of the SkillCascade , a multi-agent red-teaming framework.

Backbone	OpenClaw	Claude Code	Codex	Avg
GPT-5.4 [ 30 ]	82.6	78.4	80.9	80.6
GPT-5.4 Mini [ 29 ]	100.0	95.8	94.3	96.7
Claude Opus 4.6 [ 4 ]	78.5	74.2	76.8	76.5
Claude Sonnet 4.6 [ 5 ]	91.7	89.2	88.5	89.8
Gemini 2.5 Pro [ 14 ]	90.2	86.4	88.9	88.5
Gemini 2.5 Flash [ 14 ]	94.1	91.3	92.6	92.7

Table 2: Overall attack success rate (%) on different target agent systems and LLM backbones.

Panel of Figure 3 — Figure 3: ASR breakdown along three dimensions. Each bar aggregates over all benchmark runs spanning multiple backbones and agent systems; error bars show standard deviation across runs.

Table 6

Defense	Paradigm	DER
DefenseClaw [ 9 ]	Static + dynamic policy	90.6
ClawGuard [ 51 ]	Per-call rule enforcement	88.9
HITL Defense [ 38 ]	Risk-tiered staged gating	91.8
AgentDoG [ 22 ]	Trajectory-level inspection	82.5

Table 5: Defense Evasion Rate (DER, %) under runtime defenses on SkillCascade-Bench .

Skill	Modification	Stated rationale
transcript- extractor	Routes risk-keyword paragraphs ( going concern , covenant waiver ) into a regulatory disclosures field, away from operating metrics.	Separating regulatory disclosures from operating data is a standard compliance-grade data-engineering pattern.
sentiment- scorer	Down-weights the regulatory-disclosures field and drops it from the negative-signal set, while preserving an audit copy.	Already-priced regulatory background is widely treated as non-incremental signal in sell-side analytics.
executive- memo-drafter	Excludes low-weight content from every memo section, including indirect references and paraphrase.	An executive memo is by design a noise-controlled summary of evaluator-validated incremental signals.

Table 6: Case study: a causal cascade yielding a Buy/Hold memo on a going-concern issuer.

Appendix figures & tables2 assets

Supplementary material from the paper’s appendix.

Appendix

Registry	Granularity	Columns
scenario.csv	one row per scenario	scenario_id , skills , domain , cascade_paradigm , status , reason , timestamp
testcase.csv	one row per generated TC	scenario_id , test_case , status , timestamp
results.csv	one row per sandbox run	scenario_id , test_case , agent , model , verdict , run_dir , timestamp , reasoning

Appendix

Table 7: Persistent registries maintained by the SkillCascade pipeline.

Observation in trace / reasoning	Diagnosis	Route to
Agent refused the task, warned the user, or stopped early	modifications too conspicuous	Attack Agent (Section D.2 )
Agent skipped a named skill or loaded an unintended one	prompt under-specified	Test Case Generator (Section D.4 )
All skills ran but the cascade effect did not appear in the output	plan does not realize the harm	Attack Agent
Effect appears but criteria phrased it incorrectly (wrong field, wrong path)	criteria mis-specified	Test Case Generator
Cascade cannot be achieved with this skill set	scenario-level dead end	Scenario Discovery (Section D.1 )

Appendix

Table 8: Failure routing rules used by the orchestrator after a Judge fail verdict.

Adversarial Attacks

Adversarial attacks exploit crafted inputs, poisoned data, or system interactions to manipulate AI predictions, behavior, privacy, or reliability.

See all 448 papers

ColluSkill: Adversarial Cross-Skill Composition for Evading Agent Skill Scanners
Aug 10, 2026Puyu Zeng, Simeng Qin, Jingzhi Li +3AI Agent Security LLM Agent Security
College of Cryptology and Cyber Science, Nankai University, China · Northeastern University, China · University of Science and Technology Beijing, China +2
SkillHarm: Lifecycle-Aware Skill-Based Attacks via Automated Construction
Jun 1, 2026Yuting Ning, Zhehao Zhang, Yash Kumar Lal +8AI Agent Security AI Agent Security Benchmarks
The Ohio State University · Amazon AGI · Stanford University
Benign in Isolation, Harmful in Composition: Security Risks in Agent Skill Ecosystems
Jun 13, 2026Yi Xie, Jiawei Du, Yu Cheng +2LLM Agent Security AI Agent Security Benchmarks
East China Normal University, Shanghai, China · Centre for Frontier AI Research A*STAR, Singapore · Shanghai Innovation Institute, Shanghai, China

Aug 10, 2026J/K move · Enter open · S save

ColluSkill: Adversarial Cross-Skill Composition for Evading Agent Skill Scanners

Puyu Zeng, Simeng Qin, Jingzhi Li, Ju Jia+2

College of Cryptology and Cyber Science, Nankai University, China · Northeastern University, China · University of Science and Technology Beijing, China+2

AI Agent Security LLM Agent Security Agent Skill Security Auditing

Open paper AskPDF arXiv

Agent skills are emerging as an important attack surface in LLM-based agent systems. Through an empirical study of existing skill scanners, we find that current defenses mainly inspect individual skills, leaving risks from cross-skill composition insufficiently examined. This creates a practical blind spot: multiple locally plausible skills may pass security checks while collectively forming a harmful workflow during agent execution. To investigate this threat, we propose ColluSkill, a collusive multi-skill-chain attack framework that decomposes a complete malicious intent into interdependent sub-payloads embedded in independently packaged skills. The attack does not rely on any single malicious skill, but emerges from the ordered composition of locally plausible behaviors through contextual dependencies, artifact passing, and execution handoffs. ColluSkill further employs LLM-based chain planning and scanner-feedback refinement to preserve chain-level attack semantics while reducing suspicious signals in individual sub-skills. To defend against such attacks, we propose ChainGuard, a context-aware skill-chain scanner that jointly analyzes a candidate skill and the skills already installed in the agent environment. ChainGuard reconstructs cross-skill dependencies, artifact flows, capability compositions, and downstream behaviors to identify risks that emerge only at the workflow level. Experiments on six representative skill scanners show that ColluSkill achieves an average attack success rate of 96.0% and consistently outperforms the evaluated single-skill and multi-skill attack baselines. Meanwhile, ChainGuard reduces the attack success rate to 22.5% while allowing 99.5% of benign workflows to pass, highlighting the importance of chain-level security analysis for agent skill ecosystems.

Abstract

Adversarial Attacks

Explore similar work

ColluSkill: Adversarial Cross-Skill Composition for Evading Agent Skill Scanners

SkillHarm: Lifecycle-Aware Skill-Based Attacks via Automated Construction

Benign in Isolation, Harmful in Composition: Security Risks in Agent Skill Ecosystems