Security checks that inspect AI add-ons one at a time can miss attacks split across several harmless-looking pieces.

This explores why security scanners that check agent skills one at a time miss attacks that only emerge when skills are chained together. The short version is that the unit of inspection and the unit of harm don't match. A scanner looks at a skill and asks whether it's malicious. But an attacker can split one malicious goal into several interdependent pieces, each packaged as its own skill. Each piece looks harmless alone, and the attack only exists in their ordered execution, carried through contextual dependencies and artifacts passed from one skill to the next Can skill scanners miss attacks hidden across multiple skills?.

The corpus also suggests this gap is worse than a blind spot, because attackers can tune against it. ColluSkill pairs chain planning with scanner feedback, and reaches about 96% average attack success across six scanners. Since scanners score each skill on its own, the feedback lets an attacker keep sanding down the suspicious-looking parts of each sub-skill, while the chain-level meaning stays intact Can attackers evade skill scanners by refining individual skills?. The scanner's per-skill score can go down even as the composed behavior stays just as dangerous.

A neighboring note points at something similar from the defender's side. Composing skills is hard even when the goal is benign. Standard LLM decomposition reaches only about 34% step-level recall when breaking a task into steps, and the choice of how finely to split a task is the main bottleneck for retrieving the right skills What blocks skill retrieval in task decomposition?. That note is about retrieval, not security, so the link is my inference. If getting the right step count is that hard for a system trying to build a chain, a scanner has a similarly hard job reconstructing one from separate pieces. Splitting an attack across skills is the attacker's version of the same granularity choice, and it's made to land where the scanner isn't looking.

The deeper point is a general one about scoring behavior. The corpus argues that anything scored is observed behavior, so a passing check only tells you the thing passed under the conditions you observed Can behavioral training prove a model always complies?. That note concerns training a model to comply, not skill scanning, but the logic carries over. A clean per-skill scan certifies each skill in isolation. It says nothing about what happens when the skills run in sequence. The corpus doesn't include a tested fix for composition-level scanning, so what a chain-aware defense would look like is still an open question here.