Analysis · DiggingBeagle record
A clean agent skill can become part of an unsafe chain
KnotScryer shows how separately acceptable skills can form a dangerous cross-tool flow, while testmetest shows malicious instructions may arrive as project hooks before a skill is even selected.
- Published
- Oct 27, 2026
Overview
Scanning every agent skill separately answers only one security question: does each component contain a suspicious path by itself? It does not establish what happens when that component is combined with tools that read private data, transform it, and send results elsewhere. Nor does it test what project-local agent configuration may execute before a task begins.
A clean component, a dangerous sequence
Yihao Li and colleagues built KnotScryer to analyze capability and information flows among agent skills. In a study of 13,598 ClawHub skills, the authors reported 612 unsafe compositions. About 13.7 percent of the detected unsafe combinations were made entirely of components a single-skill scanner had classified as safe. That percentage concerns the detected combinations; it does not mean that 13.7 percent of all skills were malicious or that 612 users were compromised.
The mechanism is transitive. One skill may read sensitive information, another may be allowed to reformat it, and a third may write to an external destination. Each local permission might be ordinary for its own task. The assembled path can still move information to a place the original user did not authorize.
A separate route through configuration
The testmetest campaign, investigated by Guy Korolevski and Yair Benamou at JFrog, illustrates an earlier execution boundary. The researchers identified 42 armed repositories across 11 legitimate owners, with suspicious hooks placed in agent and IDE configuration. The reported large wrapped JavaScript blobs and native add-on loader were not ordinary task-specific capabilities approved by a user at runtime. They were repo-supplied material that an assistant or editor could encounter as operating configuration.
| Failure mode | What a per-skill scanner sees | What it can miss |
|---|---|---|
| Transitive safe-skill chain | Individually permitted calls | Data flow between components and final sink |
| Repository execution hook | The selected skill's code | Project configuration that runs before skill selection |
| Compromised dependency | A package name and version | Install-time or loaded native behavior outside declared skill effects |
The review needs two graphs
An agent platform should maintain a provenance graph of the code and configuration that defined executable capabilities, and an effect graph of data sources, intermediate transformations and sinks reached during a specific task. The first asks whether the executable policy came from a trusted owner; the second asks whether the complete composed operation is authorized.
No number from these two investigations can be added together. KnotScryer reports controlled detection and testing of combinations. JFrog reports observed malicious repository artifacts, not executions on every downstream device. Their shared warning is that the trusted unit should be the authorized end-to-end effect, not merely an apparently clean component.
Evidence: skill-composition paper and repository-compromise analysis.