Give an AI agent a big library of skills and the possible combinations explode — but security scanners already miss the risk.

This explores whether there is a library size at which skill combinations become too many to scan. The corpus gives no threshold. Nothing here says 500 skills is fine and 5,000 is not. It does show that the problem starts much earlier and for a different reason.

The basic arithmetic is easy to state, though it isn't from any note. Ordered chains grow fast: 1,000 skills allow roughly a million two-skill sequences and roughly a billion three-skill sequences. What the corpus adds is that today's scanners never try to cover that space. They inspect skills one at a time, so an attack split into interdependent pieces slips through. Each piece looks harmless alone, and the harm only appears when the skills run in order and pass artifacts to each other (Can skill scanners miss attacks hidden across multiple skills?). Coverage fails at two skills, so the trouble is the unit of inspection, not library size.

An attacker also doesn't have to search the whole space. ColluSkill plans one chain, then uses scanner feedback to soften each skill until it stops looking suspicious. It reached 96% average attack success across six scanners. The chain-level meaning stays intact because scanners score skills individually (Can attackers evade skill scanners by refining individual skills?). The defender would have to check every possible chain, while the attacker only needs to find one that gets through.

The legitimate side of the same problem gives a clue about scale. Real agent tasks need several skills composed together, not one selected. So routing across thousands of skills becomes decompose, retrieve, then assemble a dependency-aware plan (How should agents route across thousands of skills?). Even this narrowing is shaky: standard LLM decomposition reaches only 34% step-level recall, and getting the number of steps right recovers about 75% of the gains in iterative methods (What blocks skill retrieval in task decomposition?). Another retrieval approach lets the model ask for tools as it reasons instead of matching against everything up front (Can models decide better than retrievers which tools to use?). None of these notes applies that idea to security scanning, so a scanner that follows likely chains instead of all chains is an open direction the corpus doesn't test. A scanner that only looks at skills one at a time is already outmatched, whether the library holds twenty skills or twenty thousand.