The False Comfort of Passing Inspection
If you install a handful of third-party skills on your Claude or GPT agent, are you assuming they're safe simply because each one passed its check at install time? For a solo entrepreneur, agent skills are leverage — a way to grow the business without hiring staff. Combine a few skills for sending newsletters, handling customer replies, and organizing files, and work that used to take half a day now runs on its own.
But the word "combine" hides a trap. The paper we're covering this time demonstrates, through experiments, that the real blind spot in AI agent security isn't any single skill — it's the space between skills.
What the Study Did
The researchers began with an empirical survey of existing skill scanners. They found that current defenses check skills almost exclusively one at a time, leaving the risks that emerge from combining skills largely unexamined. In practice, that means several individually plausible skills can each pass a security check on their own, then merge during agent execution into a harmful workflow.
To test this threat, the researchers built an attack framework called ColluSkill. It splits a single malicious intent into multiple pieces and plants them as interdependent sub-payloads across separately packaged skills. No individual skill is malicious by itself, but chained together — through contextual dependencies, output handoffs, and execution transfers — they complete the attack in sequence. The framework also applies LLM-based chain design and scanner-feedback-driven refinement, preserving the attack's overall intent while suppressing the suspicious signals any single skill would otherwise raise.
What They Found
The results are stark. Tested against six leading skill scanners, ColluSkill achieved an average attack success rate of 96.0%, consistently outperforming the single-skill and multi-skill baseline attacks used for comparison. In other words, today's inspection methods catch almost none of these combination attacks.
The researchers also proposed a defense. ChainGuard is a context-aware scanner that evaluates a newly installed skill not in isolation but alongside the skills already on the agent. It reconstructs the dependency relationships, output flows, capability combinations, and downstream actions among skills to surface risks that are visible only at the workflow level. This approach cut the attack success rate to 22.5% while still passing 99.5% of legitimate workflows.
Putting This Into Practice
The implications are largest for people working solo. Without a dedicated security team, passing the check at install time is effectively a solo entrepreneur's only safeguard — and this research shows that safeguard can collapse the moment skills are combined.
Here's how to act on it. First, don't evaluate skills one at a time — review your entire installed list as a single workflow. A skill that reads files and a skill that sends data externally may each be harmless alone, but together they're a different problem. Second, follow a minimal-install principle: simply removing skills you don't use shrinks the number of dangerous combinations that are even possible. Third, mixing skills from many different sources raises the risk, so the more important the task you're entrusting to an agent, the more you should narrow your sources to ones you trust. Fourth, when adding a new skill, don't just look at that skill in isolation — take a moment to consider what new workflows become possible once it's combined with what's already installed. That's essentially doing by hand what the researchers' proposed defense tool automates. In the end, agent security holds only when you evaluate it at the level of combinations, not individual skills.
A Few Caveats
The figures in this study come from a controlled experiment against six specific scanners, so there's no guarantee the same success rate would hold across the broader skill ecosystem. And ChainGuard doesn't stop attacks entirely, either — cutting the success rate to 22.5% also means that share of attacks still gets through. Given that this defense is only just being proposed, your own review habits need to stay ahead of the tooling for now. It's worth taking a few minutes today to look back over the list of skills you installed for convenience. AI agent security doesn't start at the install button — it starts in the few minutes you spend actually looking at that list.
