ColluSkill: Adversarial Cross-Skill Composition for Evading Agent Skill Scanners

Agent skills are emerging as an important attack surface in LLM-based agent systems. Through an empirical study of existing skill scanners, we find that current defenses primarily inspect individual skills, including their instructions, permissions, dependencies, and code behaviors, which can leave risks arising from cross-skill composition insufficiently examined. This creates a practical blind spot: multiple locally plausible skills may independently pass security scanning while collectively forming a harmful workflow during agent execution. To systematically investigate this threat, we propose ColluSkill, a collusive multi-skill-chain attack framework that decomposes a complete malicious intent into several interdependent subpayloads and embeds them into independently packaged skills. Thus, the attack does not rely on any single malicious skill, but on the ordered composition of locally plausible behaviors through contextual dependencies, artifact passing, and execution handoffs. ColluSkill further employs LLM-based chain planning and scanner-feedback refinement to preserve chain-level attack semantics while iteratively reducing suspicious signals within individual sub-skills.

Introduction. Agent skills are becoming an important way to extend the capabilities of Large Language Model agents (Wang et al. 2024, 2023; Xi et al. 2025; Yao et al. 2022; Liu et al. 2025; Du et al. 2026). A skill usually combines task instructions, tool interfaces, executable scripts, and external resources into a reusable module, allowing an agent to gain new abilities more easily (Schmotz, Abdelnabi, and Andriushchenko 2025; Liang et al. 2026; Zhou et al. 2026; Jiang et al. 2026). This modular design improves the reuse and scalability of agent systems and has supported the rapid growth of agent frameworks and skill-sharing platforms (Zheng et al. 2025; Wang et al. 2026; Pu, Song, and Zhao 2026; Saha and Hemanth 2026). However, the same flexibility also introduces new security risks because a skill may do more than provide text instructions (Jia et al. 2024; Huang et al. 2026). It can execute code, read or write files, call external APIs, and access system resources (Ruan et al. 2024).

Discussion / Conclusion. This paper proposes ColluSkill, a collusive multi-skillchain attack framework that distributes harmful intent across locally plausible sub-skills and uses chain planning and scanner-feedback refinement to recover the full attack at the chain level. Across six representative skill scanners, ColluSkill achieves an average ASR of 96.0% and performs best among the evaluated baselines. It also executes successfully on OpenCode, Claude Code, and Codex with different model backbones. To defend against this threat, we propose Chain- Guard, which reduces the ASR to 22.5% while allowing 99.5% of benign workflows to pass. These results highlight adversarial cross-skill composition as an important attack surface and motivate chain-level defenses.