ColluSkill makes benign-looking skills combine into harmful workflows
The ColluSkill preprint splits a malicious objective across individually plausible agent skills whose handoffs, order, and shared artifacts create the harmful behavior only in combination. Across six scanners, the authors report a 96.0% average attack-success rate; their joint installed-skill scanner, ChainGuard, reduced it to 22.5% while passing 99.5% of benign samples.
Why it matters: Per-skill review can miss the actual security boundary when agents compose tools, artifacts, and instructions across an installed skill set.