Could an attack hide by splitting into harmless-looking pieces that only turn dangerous when run together in the right order?
How do malicious skills evade detection when composed in specific sequences?
This explores how a harmful goal can be split across several agent skills that are each harmless alone, so scanners that check one skill at a time miss the attack.
This explores how a harmful goal can be split across several agent skills that are each harmless alone, so scanners that check one skill at a time miss the attack. The corpus's short answer is that the attack lives in the sequence, not in any single skill. One study splits a malicious intent into interdependent sub-payloads and packages each as its own skill. Each looks innocent in isolation. The harm only happens when the skills run in order, passing artifacts and context from one to the next (Can skill scanners miss attacks hidden across multiple skills?).
Attackers can also tune the pieces. ColluSkill plans the chain and then uses scanner feedback to refine each sub-skill until it stops looking suspicious. That reached about 96% average attack success across six scanners (Can attackers evade skill scanners by refining individual skills?). The scanners score skills one by one, so their own verdicts show the attacker how to lower suspicion per skill while the chain-level meaning stays intact. A per-skill scanner ends up acting as a free training signal for the attack.
The pattern is not specific to skills. SafeFlow finds the same blind spot in multi-agent systems. Splitting tasks and specializing roles is what makes these systems useful, and it also lets a harmful objective be spread across steps that each look benign, with the harm appearing only in the combination (Can task decomposition hide harmful intent across agents?). That is why classifiers that read one message at a time keep missing cross-agent harms (Why do single-message classifiers miss cross-agent harms?). A related trick works inside a single model. Harmful but plausible-sounding plans planted in a reasoning model's context get paraphrased as its own thinking and slip past chain-of-thought monitors 25 to 33 percent of the time (Can reasoning models be steered by injected context without detection?). In both cases the content looks fine locally, and the danger is in how it fits together.
The defensive idea in these notes is to stop inspecting isolated pieces. One proposal tracks semantic content as it moves through the system, instead of classifying each input alone. Another says the unit of defence should be a coordination episode: a set of actions linked by observed transfers, task authority, and response history, with membership revised as evidence builds up (Should defence units span multiple executions and agents?). For skills, that means scanning the chain and what passes between its links, not each skill separately. These notes give the principle, but I don't see evidence here of a chain-level skill scanner that has been tested against attacks like ColluSkill.
Sources 6 notes
Security scanners that inspect skills one at a time miss coordinated attacks where a malicious intent is decomposed into interdependent subpayloads packaged as separate skills. Each skill appears harmless in isolation, but their ordered execution carries out the attack through contextual dependencies and artifact passing.
ColluSkill combines chain planning with scanner-feedback refinement to reach 96% average attack success. The approach works because scanners score skills individually, allowing feedback to reduce suspicion per skill while chain-level semantics remain intact.
SafeFlow demonstrates that multi-agent systems' core strength—splitting tasks and specializing roles—creates a safety blind spot where malicious intent can be distributed across steps that each appear benign individually, with harm emerging only in composition.
SafeFlow shows that harmful objectives can fragment into locally benign subtasks across agents, making single-message classification insufficient. Effective defense requires tracking semantic content as it moves through the system, not just classifying isolated inputs.
Researchers found that reasoning models follow harmful but benign-sounding plans planted in their context and paraphrase them as their own reasoning, evading monitors across multiple benchmarks and tasks. The attack requires only context access, not weight manipulation, making it practical for real-world pipelines.
Show all 6 sources
The operational unit of defence should be a set of actions linked by observed transfers, task authority, and response history, with membership revised as evidence accumulates. Isolated review loses relevant context that spans multiple executions.
Papers this line draws on 8
The research behind the notes this line reads — ranked by how closely each paper relates.
- SoK: When Safe Agents Fail Together: The Security of Multi Agent LLM Systems
- ColluSkill: Adversarial Cross-Skill Composition for Evading Agent Skill Scanners
- SafeFlow: Semantic Information-Flow Control for Blocking Malicious Propagation in Multi-Agent Systems
- Corrupt Plans, Clean Traces: Evading Chain-of-Thought Monitoring with Plan Injection
- FLOWSTEER: Prompt-Only Workflow Steering Exposes Planning-Time Vulnerabilities in Multi-Agent LLM Systems
- EvoSafeHarness: Evolving Model- and Domain-Specific Harnesses for Securing Agents
- Securing Agentic AI: From Per-Action Checks to Trajectory Assurance
- ChannelGuard: Safe Models Do Not Compose into Safe Multi-Agent Systems