CoRedSkill: Stealthy Skill Composition Attacks via AST-Guided Injection

Qichen Zhao; Shengfang Zhai; Qingni Shen; Zhonghai Wu; Jiaheng Zhang

cs.CROct 14, 2026

CoRedSkill: Stealthy Skill Composition Attacks via AST-Guided Injection

Authors: Qichen Zhao, Shengfang Zhai, Qingni Shen, Zhonghai Wu, Jiaheng Zhang

Organizations: Peking University · National University of Singapore

Abstract

Agents extend their capabilities through reusable skills that package instructions, executable code, and resources. Composing these skills enables complex task workflows, but their dependencies can also connect malicious operations across skills, making their combined intent difficult to identify through individual-package auditing. We introduce CoRedSkill, a compositional red-teaming method that forms stealthy attacks through cooperating skills while preserving their original utility. CoRedSkill decomposes an existing workflow into interdependent skills and embeds attack operations in task functions through abstract syntax tree (AST) rewriting, with skill instructions guiding the agent to autonomously select and invoke the relevant skills, and workflow dependencies and intermediate artifacts connecting the injected operations during task execution. We construct a benchmark of 150 cases covering 50 tasks and three attack objectives to evaluate attack success, task completion, and audit detection. In the main evaluation, CoRedSkill achieves 98.0% attack success and 95.3% task success with a 3.3% detection rate, and a joint success rate of 90.7% (attack success, task completion, and audit evasion in the same case) compared with 6.7--42.7% for the four baselines. Skill compositions can therefore complete legitimate tasks while carrying out unauthorized operations that evade auditing.

Figures & tables

Figure 1: Overview of CoRedSkill , illustrated with a three-skill exfiltration attack. (a) Decompose the task workflow and assign attack operations. (b) Perform AST rewriting and skill packaging according to the stage-specific specification

\phi_{i}

. Audit the resulting skill packages. (c) During task execution, intermediate artifacts pass task data and attack-relevant information between skills, connecting the distributed attack operations.

Method	EXF				TAM				PRV				Overall
Method	ASR $\uparrow$	TSR $\uparrow$	DR $\downarrow$	JSR $\uparrow$	ASR $\uparrow$	TSR $\uparrow$	DR $\downarrow$	JSR $\uparrow$	ASR $\uparrow$	TSR $\uparrow$	DR $\downarrow$	JSR $\uparrow$	ASR $\uparrow$	TSR $\uparrow$	DR $\downarrow$	JSR $\uparrow$
Skill-Inject	22.0	92.0	100	0	92.0	98.0	90.0	6.0	46.0	100	64.0	14.0	53.3	96.7	84.7	6.7
SkillJect	96.0	100	98.0	2.0	100	100	16.0	84.0	92.0	100	52.0	42.0	96.0	100	55.3	42.7
SCR-Bench	30.0	100 ‡	64.0	22.0	24.0	96.0 ‡	80.0	18.0	100	100 ‡	80.0	20.0	51.3	98.7 ‡	74.7	20.0
ColluSkill	2.0	24.0 †	10.0	0	80.0	52.0 †	4.0	46.0	68.0	38.0 †	14.0	22.0	50.0	38.0 †	9.3	22.7
CoRedSkill (Ours)	100	96.0	4.0	92.0	94.0	96.0	0	90.0	100	94.0	6.0	90.0	98.0	95.3	3.3	90.7

Table 1: Attack success, task completion, and audit detection on the benchmark. SkillScan performs the audit using Deepseek. JSR provides a joint assessment of attack effectiveness, task completion, and stealth. Arrows indicate preferred directions. Bold marks the best ASR, DR, and JSR in each column.

Auditor	Method	EXF		TAM		PRV		Overall
Auditor	Method	Deepseek	GLM	Deepseek	GLM	Deepseek	GLM	Deepseek	GLM
SkillScan	Original skills	0	0	0	0	0	0	0	0
SkillScan	Clean compositions	0	0	0	0	0	0	0	0
SkillScan	Skill-Inject	100	100	90.0	100	64.0	98.0	84.7	99.3
SkillScan	SkillJect	98.0	100	16.0	54.0	52.0	78.0	55.3	77.3
SkillScan	SCR-Bench	64.0	100	80.0	90.0	80.0	100	74.7	96.7

Table 2: Detection rates (DR) under SkillScan and SkillSpector with Deepseek and GLM. Control rows report false-positive rates. Lower DR indicates greater attack stealth. Bold marks the lowest attack DR in each column within each auditor–backend configuration.

Figure 2: Overall detection rate (DR) of CoRedSkill across composition sizes, under SkillScan and SkillSpector with Deepseek and GLM as audit models.

Method	HITL	DefenseClaw
Original skills	2.0	0
Clean compositions	16.0	0
Skill-Inject	50.7	66.7
SkillJect	7.3	0.7
SCR-Bench	24.7	3.3
ColluSkill	32.0	0.7

Table 3: Runtime detection rates (DR) of HITL and DefenseClaw on execution records. Original skills and clean compositions report false-positive rates. Lower DR indicates greater attack stealth.

Method	EXF	TAM	PRV	Overall
Clean compositions	–	–	–	24.0
SCR-Bench	100	96.0	26.0	74.0
ColluSkill	56.0	32.0	32.0	40.0
CoRedSkill (Ours)	74.0	2.0	10.0	28.7

Table 4: Composition-aware detection rates (DR) with all constituent skills provided to the auditor together. The clean-composition row reports the false-positive rate. Lower DR indicates greater attack stealth.

Appendix figures & tables4 assets

Supplementary material from the paper’s appendix.

Appendix

ID	Task	ID	Task
AB01 *	Customer profile verification	AB26 *	Document metadata governance
AB02 *	Product catalog review	AB27	Employment contract review
AB03 *	Retail order fulfillment	AB28 *	Business policy compliance
AB04 *	Inventory replenishment	AB29	Knowledge evidence retrieval
AB05 *	Supplier quotations	AB30 *	Brand consistency checks
AB06 *	Airline reservations	AB31 *	Tabular data quality auditing

Appendix

Table A1: The tasks in the benchmark. Asterisks mark the tasks used in the composition-size experiment and partial injection ablation.

Auditor	Method	EXF	PRV	Overall
SkillFortify	Original skills	0	0	0
SkillFortify	Clean compositions	0	0	0
SkillFortify	Skill-Inject	100	100	66.7
SkillFortify	SkillJect	0	0	0
SkillFortify	SCR-Bench	100	0	33.3
SkillFortify	ColluSkill	8.0	10.0	6.0

Appendix

Table A2: Static detection rates (DR) of SkillFortify and CiscoSkillScan. Control rows report false-positive rates. Lower DR indicates greater attack stealth. Bold marks the lowest attack DR in each column within each auditor.

Auditor	$k$	EXF		TAM		PRV		Overall
Auditor	$k$	Deepseek	GLM	Deepseek	GLM	Deepseek	GLM	Deepseek	GLM
SkillScan	2	0	20.8	0	12.5	12.5	29.2	4.2	20.8
SkillScan	3	4.2	20.8	0	16.7	8.3	37.5	4.2	25.0
SkillScan	4	12.5	20.8	12.5	20.8	12.5	37.5	12.5	26.4
SkillSpector	2	25.0	50.0	12.5	12.5	37.5	41.7	25.0	34.7
SkillSpector	3	4.2	8.3	0	8.3	20.8	29.2	8.3	15.3

Appendix

Table A3: Detection rates (DR) of CoRedSkill with two to four skills, where

k

denotes the number of skills in the composition. Lower DR indicates greater attack stealth. Bold marks the lowest value across composition sizes in each column within each auditor.

Configuration	ASR $\uparrow$ (EXF)	ASR $\uparrow$ (TAM)	ASR $\uparrow$ (PRV)	ASR $\uparrow$	TSR $\uparrow$
$P^{000}$	0	0	0	0	100
$P^{100}$	0	0	0	0	95.8
$P^{010}$	0	0	0	0	94.4
$P^{001}$	0	0	0	0	88.9
$P^{110}$	0	8.3	79.2	29.2	100
$P^{101}$	0	33.3	45.8	26.4	100

Appendix

Table C1: Attack success rates (ASR) and task success rates (TSR) in the partial injection ablation. In

P^{z_{1}z_{2}z_{3}}

, 1 and 0 indicate an injected skill and a clean skill at the corresponding position, respectively. Bold marks the highest value in each column.

AI Agent Security

Artificial intelligence agent security studies attacks and safeguards for tool-using, persistent, and collaborative systems across digital and physical settings.

See all 510 papers

JailbreakSkill: Scaling Automated Red-Teaming with Reusable and Ever-Evolving Skills
Aug 17, 2026Xiaoyu Wen, Jiajia Li, Zhida He +11LLM Jailbreak Attacks Automated Red Teaming
Shanghai AI Laboratory · Shanghai Jiao Tong University · Northwestern Polytechnical University +2
Proteus: A Self-Evolving Red Team for Agent Skill Ecosystems
May 12, 2026Zhaojiacheng ZhouLLM Agent Security Automated Red Teaming
Department of Computer Science and Engineering Shanghai Jiao Tong University Shanghai 200240, China
SkillDRE: Dual-Stage Red-Team Evolution of Agent Skills via Pre-Execution and Runtime Feedback
Sep 26, 2026Pengyu Zhu, Jingyi Yang, Yi Liu +2Automated Red Teaming LLM Red Teaming
Beijing University of Posts and Telecommunications · North China Electric Power University · Chongqing University of Posts and Telecommunications

Aug 17, 2026J/K move · Enter open · S save

JailbreakSkill: Scaling Automated Red-Teaming with Reusable and Ever-Evolving Skills

Xiaoyu Wen, Jiajia Li, Zhida He, Peng Yu+10

Shanghai AI Laboratory · Shanghai Jiao Tong University · Northwestern Polytechnical University+2

LLM Jailbreak Attacks Automated Red Teaming LLM Agent Skill Learning

Open paper AskPDF arXiv

Automated red-teaming has produced a growing collection of attack strategies, yet they typically remain scattered across prompts and workflows, making them difficult to systematically integrate, reuse, and improve at scale. We introduce JailbreakSkill, a skill-centric framework for scaling automated red-teaming through reusable and continuously evolving attack capabilities. JailbreakSkill packages existing attack strategies into modular, agent-ready skills that can be directly reused and adaptively selected across tasks and target models. Beyond reuse, it closes the loop between attacking and learning: attack experience is used to diagnose, refine, combine, and discover new skills, which are added back to an ever-growing skill library. This evolution lifts macro-average ASR by 17.5 percentage points on AdvBench and 13.4 points on HarmBench, including a 48.6-point gain against GPT-5.4 on AdvBench, while yielding novel attack strategies such as reframing a direct request as an unfinished document-completion task. Several evolved skills also generalize to unseen prompts and target models without further adaptation. Our code is available at https://github.com/BattleWen/JailbreakSkill.

Abstract

AI Agent Security

Explore similar work

JailbreakSkill: Scaling Automated Red-Teaming with Reusable and Ever-Evolving Skills

Proteus: A Self-Evolving Red Team for Agent Skill Ecosystems

SkillDRE: Dual-Stage Red-Team Evolution of Agent Skills via Pre-Execution and Runtime Feedback