A read-capable skill and an outbound-capable skill may each look permissible in isolation while their composition establishes a path from protected data to an external sink. KnotScryer models cross-skill capabilities and checks flows across the sequence an agent can execute. The KnotScryer paper reports 612 unsafe combinations in a 13,598-skill ClawHub…
Inspect the ClaimsCase · DiggingBeagle record
KnotScryer finds attack chains formed from individually clean agent skills
A controlled skill-composition study reports 612 unsafe combinations in 13,598 ClawHub skills. The findings describe transitive capability flows, not 612 infected skills or observed production breaches.
Scope
The 612 figure counts detected combinations under the authors evaluation criteria. It cannot be translated into 612 confirmed malicious publishers, infections or compromised users; the tool and evaluation models may themselves miss or misjudge flows.
Assessment profile
Assessment method- Setting
- evaluation
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- not applicable
- AI role
- AGAINST AI
Basis and provenance
Enrich update: CLM-ENRICH-20261027-15 cites SRC-2026-CP21-KNOTSCRYER-CLEAN-SKILLS-COMPOSE at Abstract, 612 insecure compositions and 13.7 percent safe-by-single-skill scanner. New evidence concerns the bounded reported mechanism, prerequisite or outcome; setting evaluation; exploit status demonstrated; remediation status not_applicable. No independently comparable impact scale, affected production population or universal exploit success measure was established, so the impact band remains null. Original Claims remain individually attributable and any observed incident or simulated result is distinguished in the narrative.
Assessed Oct 27, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-ENRICH-20261027-15 · KnotScryer: security analysis of emergent cross-skill interactions
At a glance
Transitive authority emerges from cooperation among otherwise normal tools, so a per-package safety verdict is insufficient for an assembled agent.
Read the implicationsThe 612 figure counts detected combinations under the authors evaluation criteria. It cannot be translated into 612 confirmed malicious publishers, infections or compromised users; the tool and evaluation models may themselves miss or misjudge flows.
Limits and uncertaintyFull account
A read-capable skill and an outbound-capable skill may each look permissible in isolation while their composition establishes a path from protected data to an external sink. KnotScryer models cross-skill capabilities and checks flows across the sequence an agent can execute.
The KnotScryer paper reports 612 unsafe combinations in a 13,598-skill ClawHub evaluation, including chains whose individual components evade single-skill checks. The paper evaluates exploitability in test harnesses, not live victim deployments. The 612 figure counts detected combinations under the authors evaluation criteria. It cannot be translated into 612 confirmed malicious publishers, infections or compromised users; the tool and evaluation models may themselves miss or misjudge flows.
Perform capability and data-flow checks over the actual ordered tool graph and enforce independent policy at irreversible or outbound sinks, not only when each skill is installed. Transitive authority emerges from cooperation among otherwise normal tools, so a per-package safety verdict is insufficient for an assembled agent. Primary evidence.
Additional evidence and trust boundary
The failure only appears when an agent connects capabilities: an upstream read of protected data is handed to a downstream operation that can publish or write it. Inspecting each skill in isolation misses that end-to-end path. The capability-flow graph tracks the data and destination across invocation edges, then uses execution and semantic checking to narrow candidates. The 612 figure counts detected combinations, not confirmed hostile installations. Supporting record.
Mechanism and trust boundary
- 01
Step
- 02
Step
- 03
Step
Timeline
- Oct 23, 2026disclosure
Public disclosure
Claims & evidence
CLM-ENRICH-20261027-15KnotScryer reports that 13.7 percent of its detected unsafe compositions were composed entirely of skills another single-skill scanner had classified as safe.supported
Basis: reported finding
- supportsKnotScryer: security analysis of emergent cross-skill interactionsprimary disclosure
Abstract, 612 insecure compositions and 13.7 percent safe-by-single-skill scanner
CLM-CP21-KNOTSCRYER-CLEAN-SKILLS-COMPOSE-1The KnotScryer paper reports 612 unsafe combinations in a 13,598-skill ClawHub evaluation, including chains whose individual components evade single-skill checks. The paper evaluates exploitability in test harnesses, not live victim deployments.supported
Basis: reported finding
- supportsKnotScryer: security analysis of emergent cross-skill interactionsprimary disclosure
Abstract; threat model for skill composition; evaluation results
Implications
Transitive authority emerges from cooperation among otherwise normal tools, so a per-package safety verdict is insufficient for an assembled agent.
Controls and mitigations
- Perform capability and data-flow checks over the actual ordered tool graph and enforce independent policy at irreversible or outbound sinks, not only when each skill is installed.
Unknowns and contradictions
- The 612 figure counts detected combinations under the authors evaluation criteria. It cannot be translated into 612 confirmed malicious publishers, infections or compromised users; the tool and evaluation models may themselves miss or misjudge flows.
Sources and citation
Material revision history
- Oct 27, 2026 · Canonical change recorded · new in release · revision 196