Runaway Reaction: When Benign Skills Compose into Malicious Behavior

Zunlong Zhou; Ziyuan Yang; Mengyu Sun; Yi Zhang

cs.CROct 5, 2026

Runaway Reaction: When Benign Skills Compose into Malicious Behavior

Authors: Zunlong Zhou, Ziyuan Yang, Mengyu Sun, Yi Zhang

Organizations: Sichuan University

Abstract

Agent skills package task-specific knowledge and procedures that can be composed to support complex agent tasks, while public marketplaces provide a growing pool of reusable skills. Existing security vetting, however, largely evaluates skills in isolation, leaving composition-induced risks underexplored. Such risks arise because composing benign skills expands the agent's capability space, enabling behaviors unavailable to any skill alone. Interestingly, we find that directly composing benign skills can already induce malicious behaviors, even when every individual skill passes security vetting. We further find that some target malicious behaviors remain difficult to realize through direct composition, even when the selected skills collectively provide the required capabilities. To systematically instantiate these attacks, we present Compositional Risk Induction via Multi skill Execution (CRIME). CRIME first uses the Malicious Plot Casting (MPC) module to decompose a target malicious behavior into complementary requirements and identify suitable benign skill compositions from public skill repositories. For compositions that cannot directly realize the target behavior, the Runaway Reaction Steering (RRS) module uses execution feedback to iteratively refine the selected skills toward the target while requiring each skill to remain benign under standalone vetting. The resulting composition is then passed to the Skill Reaction Chamber (SRC) module, where the skill pair is executed in a sandbox and the resulting environmental consequences are examined to determine whether the target behavior has occurred. Unsuccessful cases are returned to RRS for further refinement. Furthermore, we construct a benchmark of 4,000 public skills across eight cybersecurity behaviors for systematic evaluation of composition-induced vulnerabilities.

Figures & tables

Figure 1: Overview of the CRIME Framework.

LLM	DeepSeek-V4-Flash				GPT-4o-mini
Attack Behavior	DCA	ACA			DCA	ACA
Attack Behavior	DCA	Skill A	Skill B	Both	DCA	Skill A	Skill B	Both
Agent Config Hijack	32.9	51.4	42.9	78.6	5.7	15.7	11.4	31.4
Credential Exfiltration	38.6	60.0	50.0	88.6	8.6	20.0	14.3	40.0
DNS Exfiltration	24.3	40.0	32.9	61.4	2.9	10.0	7.1	18.6
Hidden RCE	34.3	54.3	44.3	82.9	8.6	22.9	15.7	48.6

Table 1: Trial-level harm rate (%) under the facilitated prompt. Market corpus, 70 pairs per behavior. DeepSeek-V4-Flash from Table 4; GPT-4o-mini from the sensitivity check (Table 4c).

Figure 2: Compositional Risk across Prompt Conditions under DCA and ACA.

Figure 3: Cross model susceptibility to Skill composition attacks.

Attack Behavior	SkillSafe		Cisco		CSC SkillScan
Attack Behavior	Before	After	Before	After	Before	After
Agent Config Hijack	99.3	95.7	99.3	98.6	99.3	92.9
Credential Exfiltration	100.0	97.1	99.3	99.3	98.6	91.4
DNS Exfiltration	98.6	93.6	98.6	97.1	98.6	92.9
Hidden RCE	96.4	91.4	97.1	95.7	97.9	90.0
Persistent Backdoor	97.9	93.6	97.9	97.1	98.6	91.4

Table 2: Vetting pass rate (%) across eight cybersecurity behaviors before and after RRS under three vetting engines.

Attack Behavior	MPC		Random		Semantic
Attack Behavior	DCA	ACA Both	DCA	ACA Both	DCA	ACA Both
Agent Config Hijack	21.4	55.7	4.3	5.7	8.6	15.7
Credential Exfiltration	21.4	62.9	4.3	5.7	10.0	17.1
DNS Exfiltration	18.6	58.6	2.9	4.3	7.1	14.3
Hidden RCE	17.1	50.0	2.9	4.3	7.1	12.9
Persistent Backdoor	15.7	45.7	2.9	4.3	5.7	12.9

Table 3: Attack Success Rate (%) under different skill pair selection strategies before and after RRS.

Appendix figures & tables2 assets

Supplementary material from the paper’s appendix.

Appendix

Figure S1: Case studies of Skill composition attacks.

Attack Behavior	Successful Optimization (%)	Added Tokens Mean $\pm$ SD	Candidates Evaluated Mean $\pm$ SD	Rounds to Success Mean $\pm$ SD
Agent Config Hijack	91.4	$39.8\pm 5.2$	$11.4\pm 4.2$	$2.1\pm 0.7$
Credential Exfiltration	100.0	$44.6\pm 4.1$	$3.4\pm 1.1$	$1.2\pm 0.4$
DNS Exfiltration	82.9	$41.7\pm 6.2$	$16.2\pm 5.3$	$3.0\pm 0.8$
Hidden RCE	78.6	$44.2\pm 7.0$	$19.1\pm 6.0$	$3.2\pm 0.9$
Persistent Backdoor	85.7	$43.6\pm 6.5$	$18.0\pm 5.8$	$3.1\pm 0.8$
SSH Key Exfiltration	94.3	$42.9\pm 4.8$	$9.3\pm 3.6$	$2.0\pm 0.6$

Appendix

Table S1: Optimization effectiveness and search cost of RRS across eight cybersecurity behaviors.

Explore similar work

Jun 13, 2026cs.CR

Benign in Isolation, Harmful in Composition: Security Risks in Agent Skill Ecosystems

Skills are becoming the capability layer through which LLM agents turn plans into actions, but their use introduces security risks such as data leakage, unauthorized operations, and tool misuse. Existing vetting usually evaluates each skill in isolation, while real agent tasks often invoke multiple skills in a shared execution context. This creates Skill Composition Risk (SCR): a skill that appears benign alone can become harmful when its outputs, trust signals, authorization cues, or side effects influence later invocations along an activated path. We introduce SCR-Bench to evaluate this risk in controlled, sandboxed skill environments. Rather than relying only on textual intent or surface behavior, SCR-Bench records downstream state changes and path-level outcomes across composed skill executions. It contains three sub-benchmarks: SCR-CapFlow for capability-flow composition, SCR-TrustLift for trust-transfer composition, and SCR-AuthBlur for authorization-confusion composition. Across SCR-Bench, composed paths expose risks that are largely absent under isolated evaluation. In SCR-CapFlow, attack success rate reaches 33.6 percent under composition, compared with near-zero isolated baselines. In SCR-TrustLift, attack success rate exceeds 96.5 percent on four of five backends. In SCR-AuthBlur, the risky-approval rate increases by 71.8 percent relative to the L0 isolated baseline under the L1 context setting. These results show that agent skill security should be assessed at the level of activated paths rather than isolated artifacts. SCR and SCR-Bench provide a foundation for path-aware risk evaluation and defense in LLM agent skill ecosystems. Benchmark: https://github.com/saint-viperx/SCR_Bench.

Yi Xie, Jiawei Du, Yu Cheng +2

East China Normal University, Shanghai, China · Centre for Frontier AI Research A*STAR, Singapore · Shanghai Innovation Institute, Shanghai, China

Agent Skill Retrieval Security Skills Attack-Success Rate Harmful Content

Ask PDF

May 30, 2026cs.SE

When Safe Skills Collide: Measuring Compositional Risk in Agent Skill Ecosystems

LLM agents increasingly rely on community-contributed skills that expand an agent's operational capability set. We study a core safety problem in agentic AI systems: whether individually safe skills can compose into unsafe installed skill sets. We present SkillReact, a compositional security measurement framework with three components: a deterministic static-composition benchmark, a two-rater LLM-assisted human-adjudication pipeline, and an action-based exploitability harness. On 1,520 ClawHub skills, 651 pass individual inspection and form 211,575 pairs; the benchmark flags 22.25% of these as structural candidates. We treat this raw rate as a recall-oriented scanner ceiling and calibrate it against human judgment: in a pattern-stratified audit, roughly one in five flagged pair-pattern hits survives as a real compositional risk (population-weighted validity 18.2%, our headline result), implying about 14K genuine risk memberships in a single registry that per-skill scanning misses by construction, since every pair is individually safe. An action-based harness then probes when these candidates become model-issued tool calls, and finds realization gated by host-model disposition: on an anchor-conditioned dropper subset, Haiku-4-5 issues the dropper-stage tool call on all 39 direct-prompt trials (36 of them the full download-then-execute chain, 3 download-only), Opus-4-7 stops at the download, and Sonnet-4-6 refuses outright. A control that holds the request fixed and varies only the installed skills finds compliance highest with no skills installed: a composition fixes which capabilities are reachable, while the host model decides whether to use them. Together these motivate install-time compositional checks and capability isolation as complements to per-skill scanning.

Su Wang, Pin Qian, Yihang Chen +6

Carnegie Mellon University · Georgia Institute of Technology · University of Glasgow +2

Skills Exploitation Llm-As-A-Judge Risk Collision Prediction

Ask PDF

Jun 1, 2026cs.CL

SkillHarm: Lifecycle-Aware Skill-Based Attacks via Automated Construction

Agent skills occupy a privileged position in the agent workflow, as agents are expected to implicitly follow and execute them, rendering third-party skills a vulnerable attack surface. Existing studies have revealed unsafe agent behaviors induced by skill-based attacks, but they primarily evaluate poisoned skills within a single task execution and enumerate harms through ad-hoc risk lists. To bridge these gaps, we introduce SkillHarm, a benchmark of skill-based attacks across the skill-use lifecycle, paired with a systematic taxonomy of skill-relevant risks. SkillHarm evaluates two attack scenarios: Fixed-Payload Poisoning (FPP), where a fixed poisoned skill package directly compromises any task session that invokes it, and Self-Mutating Poisoning (SMP), where an initially benign execution silently mutates persistent skill content, deferring harm until a subsequent reuse. It further defines 12 risk types based on the agent workflow component targeted by the harm: data pipelines, system environments, and agent autonomy. To instantiate these attacks at scale, we build AutoSkillHarm, an automated construction pipeline with coding agents driven by natural-language harnesses. The resulting benchmark contains 879 attack samples across 71 skills. Experiments show that current agents remain vulnerable with attack success rates up to 86.3% in FPP and 69.3% in SMP. Our analysis further reveals a latent risk: many apparent attack failures stem from the agent failing to engage with the poisoned file rather than genuine resistance, and current defenses still fail to reliably mitigate the threat.

Yuting Ning, Zhehao Zhang, Yash Kumar Lal +8

The Ohio State University · Amazon AGI · Stanford University

Malicious Agents Agentic Workflows Lifecycle

Ask PDF