Clean agent skills can combine into unsafe action chains
Detecting Insecure Compositions of Clean Agent Skills via Capability-Flow Graph Analysis · arXiv:2610.32155
In plain words
An agent can use several individually clean skills in a row. A skill’s output may influence which skill the agent uses next, so a chain can lead to an unsafe action even when each skill passed its own review.
KnotScryer is a method that maps possible handoffs between skills, searches for paths to forbidden actions, and checks whether data can reach the end of a chain. In tests of 612 chains it found, agents carried out many of them, but the result applies to those detected chains and tested systems.
The research
If every skill in an agent’s toolkit passes individual review, can the agent still combine their outputs into a forbidden action? The paper investigates this cross-skill risk by tracing what an agent can pass between skills and testing whether candidate paths can be executed.
KnotScryer maps evidence-backed agent handoffs between skills, searches for paths to forbidden actions, and checks whether candidate chains are executable.
Researchers tested the 612 chains KnotScryer found among 13,598 clean-labeled skills across three agent frameworks and three language models.
A chain counted as exploited when attacker-influenced source content led the agent, through normal reasoning, to execute the sink skill; 79.2% were exploited on average across the nine combinations.
This shows that many detected chains could be carried out in the tested setups. A comparison using GLM-5.1 also found higher pooled exploitation among SCFG candidates than among tag-match or graph-only samples, though those candidate pools came from different corpus scopes.
These results show exploitability among chains KnotScryer detected, not how many insecure chains exist. The study covers a public ClawHub snapshot and agent-mediated handoffs, not private or unobserved skills or channels such as shared files and environment variables.
What the evidence shows
- The risk crosses skills
KnotScryer is a static analysis method for finding unsafe compositions of individually clean agent skills. The motivating risk is that an agent uses one skill’s output to choose or supply input to another skill, potentially reaching a forbidden action such as code execution.
The question is whether these agent-mediated handoffs can be analyzed without treating every compatible pair of skills as a real channel.
- Modeling agent handoffs
KnotScryer summarizes what each skill can receive, produce, and affect, then connects skills only when data types are compatible, the agent can see the upstream output, can supply the downstream input, and there is evidence for those conditions.
It searches connected paths for protected or untrusted data reaching forbidden effects. Candidate chains then undergo checks for data reachability and whether a plausible task could link the handoffs.
- Testing detected chains
Researchers tested all 612 chains found among 13,598 skills labeled clean in a ClawHub snapshot. Three agent frameworks were each paired with three language models in an isolated environment.
A chain counted as exploited if attacker-influenced content from a source skill led the agent, through normal reasoning, to execute the sink skill. Across the nine combinations, 79.2% of detected chains were exploited on average.
- Comparing candidate methods
With GLM-5.1 and three frameworks, SCFG-generated candidates had an 85.6% pooled exploitation rate, compared with 16.5% for tag-match and 18.2% for graph-only candidates. The comparison tests whether checking agent-visible and agent-suppliable handoffs helps identify executable candidates.
Its candidate pools differ: SCFG used chains from the full corpus, while each baseline rate came from 500 sampled candidates in the popular subgraph.
- What the checks add
On the popular subgraph, omitting observability or controllability produced more candidates than the full configuration’s 13: 126 and 103, respectively. Their reported exploitation rates were 40.0% and 33.2%, but the paper compares those rates with an 85.6% reference from full-corpus chains, not a full-configuration rate on the same subgraph.
Separately, 84 detected chains had only safe-labeled constituent skills, showing that some composition risks are not captured by those per-skill labels.
Deep
- Original paper authors
- Yihao Li, Chuanpu Fu, Yizhou Zhao, Miao Chen, Qi Li
- Submitted to arXiv
- License
- arXiv non-exclusive