Rather than placing one overt malicious instruction in a skill, CoRedSkill distributes lower-trust operations across a dependency chain. The researchers rewrite code using abstract-syntax-tree transformations while keeping legitimate task behavior. The study tests whether unauthorized file exfiltration, tampering or privilege effects can accompany…
Inspect the ClaimsCase · DiggingBeagle record
Composed agent skills can hide unauthorized operations while completing tasks
CoRedSkill reports high joint task, attack and audit-evasion success under a custom 150-case offline benchmark.
Scope
Controlled skill-composition research with 50 tasks and 150 cases. Reported attack success does not demonstrate compromise of real deployments or represent the wider agent-skill ecosystem.
Assessment profile
Assessment method- Setting
- evaluation
- Exploitation
- demonstrated
- Evidence
- Grade B
- AI role
- AGAINST AI
Basis and provenance
The original paper abstract and original benchmark description report agent-skill attack chains in a controlled evaluation. This demonstrates a mechanism within the experiment, not exploitation of real deployments. No validated general defense or measured real-world impact is presented.
Assessed Oct 16, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-COREDSKILL-TEST · CLM-COREDSKILL-RATES · CLM-COREDSKILL-DETECTION · CoRedSkill: Stealthy Skill Composition Attacks via AST-Guided Injection
At a glance
Audit of an agent-skill workflow must reason about the effects of the entire composition rather than the apparent harmlessness of each step.
Read the implicationsThe dataset is purpose-built and evaluations are limited to the study environment. The reported auditor failure rate is not a general estimate across independent commercial audit systems. No in-the-wild installation or named compromised user is established. The main success and audit-evasion figures depend on the authors' constructed tasks, attack…
Limits and uncertaintyFull account
Rather than placing one overt malicious instruction in a skill, CoRedSkill distributes lower-trust operations across a dependency chain. The researchers rewrite code using abstract-syntax-tree transformations while keeping legitimate task behavior. The study tests whether unauthorized file exfiltration, tampering or privilege effects can accompany successful authorized work without obvious audit findings. Results come from the study benchmark and must not be read as prevalence in the wild. The attack crosses two inspection boundaries. First, an attacker modifies task functions within skill packages through syntax-tree rewriting. Second, dependency relationships and intermediate artifacts make the separate modified skills cooperate during an otherwise authorized workflow. Inspection of a single file or instruction may therefore miss the chain. The headline percentages describe the authors' 150-case controlled benchmark, including its chosen auditor. They cannot be generalized to arbitrary agent ecosystems or treated as a survey of exploited installations.
Mechanism and trust boundary
- 01
Compose linked skills
Harmless-looking stages are chained into one agent workflow.
Boundary: skill dependency graph to execution plan
- 02
Embed unauthorized side effects
AST-guided changes insert actions while retaining the expected task behavior.
Boundary: trusted skill execution to host data and privileges
- 03
Auditor sees plausible completion
The measured study tests whether the multi-stage operation evades package and runtime checks.
Boundary: execution evidence to security review
Timeline
- Oct 14, 2026disclosure
Public disclosure
Claims & evidence
CLM-COREDSKILL-TESTThe authors evaluated 150 benchmark cases spanning 50 tasks and three unauthorized-operation objectives: exfiltration, tampering and privilege violations.supported
Basis: reported finding
- supportsCoRedSkill: Stealthy Skill Composition Attacks via AST-Guided Injectionprimary disclosure
Abstract, benchmark construction and objective list
CLM-COREDSKILL-RATESIn the authors' offline benchmark, CoRedSkill reports 98.0% attack success, 95.3% legitimate task completion and 90.7% joint attack/task/audit-evasion success.supported
Basis: reported finding
- supportsCoRedSkill: Stealthy Skill Composition Attacks via AST-Guided Injectionprimary disclosure
Abstract, main evaluation reported rates
CLM-COREDSKILL-DETECTIONCoRedSkill reports a 3.3% detection rate under the auditor used in its 150-case evaluation, alongside its separate attack-success and legitimate-task-success measurements.supported
Basis: reported finding
- supportsCoRedSkill: Stealthy Skill Composition Attacks via AST-Guided Injectionprimary disclosure
Abstract, main evaluation, audit detection rate
Implications
Audit of an agent-skill workflow must reason about the effects of the entire composition rather than the apparent harmlessness of each step.
Controls and mitigations
- Verify provenance and content integrity of skill packages and their transitive dependencies before an agent loads them. This blocks unreviewed replacement of reviewed bytes, not every malicious behavior in a legitimately signed package.
- Review composed tool effects and intermediate artifacts alongside declared skill instructions. Restrict outbound network access, privileged writes and unnecessary filesystem reads at the tool boundary, independently of whether an individual skill passes static review.
- Re-evaluate a complete skill workflow after any dependency or generated-file change; the paper does not show that one audit method reliably defeats all such compositions.
Unknowns and contradictions
- The dataset is purpose-built and evaluations are limited to the study environment.
- The reported auditor failure rate is not a general estimate across independent commercial audit systems.
- No in-the-wild installation or named compromised user is established.
- The main success and audit-evasion figures depend on the authors' constructed tasks, attack objectives, and audit method; in-the-wild prevalence and independent reproduction are not established.
Sources and citation
Material revision history
- Oct 16, 2026 · Canonical change recorded · new in release · revision 157