Can skill scanners miss attacks hidden across multiple skills?

The paper starts from an empirical study of existing skill scanners and reports what they look at: current defenses "primarily inspect individual skills, including their instructions, permissions, dependencies, and code behaviors," which leaves "risks arising from cross-skill composition insufficiently examined." The blind spot it draws from that is practical: "multiple locally plausible skills may independently pass security scanning while collectively forming a harmful workflow during agent execution."

ColluSkill is the attack built to sit in that gap. It decomposes "a complete malicious intent into several interdependent subpayloads" and embeds each in an independently packaged skill, so the attack "does not rely on any single malicious skill, but on the ordered composition of locally plausible behaviors through contextual dependencies, artifact passing, and execution handoffs." My reading is that "interdependent" carries the weight: a subpayload that is only one step of a chain looks like an ordinary utility when scanned alone, so its incompleteness is its camouflage. The excerpt names the three coupling routes and does not define them.

This is the SafeFlow shape moved to a different artifact. There the fragments are subtasks handed between role-specialized agents at runtime (Can task decomposition hide harmful intent across agents?); here they are packaged skills, and the check that fails is a scan of the file. The two also differ in time, which is my inference: a scanner judges a skill when it is packaged or installed, while the chain exists only when an agent composes the skills during a run. That is why sharpening the per-skill check does not help, the point Can individual components pass safety checks if the system still fails? makes for other components. The attack also rides on something agents are built to do: How should agents route across thousands of skills? argues real tasks need several skills chained, so the dependencies and hand-offs the attack relies on look like what a legitimate plan produces. By the SoK's four-way test for what interaction did to a failure, this is the composition role (Does a multi-agent setting automatically signal a security effect?), with skills as the composing parts and not agents: the excerpt describes an agent composing them and mentions no second agent. My reading is that the failure here needs several skills and not several agents, which is not the controlled single-versus-multi comparison the fragmentation notes still lack.

The obvious objection is to scan combinations. But the set of chains is not fixed at scan time: the agent assembles it per task from a library that can hold thousands of skills (a vault inference from the routing note). The paper's own answer is a chain-level defense, not pairwise scanning; see Does chain-level inspection close the cross-skill attack blind spot?.

What the excerpt does not give. The six scanners are unnamed. The empirical study's scope and measures are not described, and the excerpt does not say whether it used the same six scanners as the evaluation. There is no worked example of an intent split into subpayloads.