What's this about?
Agents doing long-horizon work increasingly pull skills from marketplaces, and those marketplaces certify skills one package at a time: a scanner returns a safety verdict for each, and if every package passes, the ecosystem is declared safe. This paper constructs compositional skill-chain attacks assembled entirely from skills that each pass the scanner individually — breaking the assumption that per-package certification adds up to a safe system.
What exactly is a composition attack?
Individually harmless capabilities can be dangerous in sequence. One skill reads files. Another summarizes text. A third sends an email. Each is obviously fine; chained, they exfiltrate your documents. Security people know this shape well — it's why permission systems reason about combinations rather than individual grants — but scanners that evaluate one package at a time are structurally blind to it, because the danger exists only in the composition and not in any component.
Why is this worth noticing?
- It attacks the certification model that skill marketplaces are currently being built on, at exactly the moment skills are becoming shareable artifacts with curators and collections.
- It's the same lesson as OpenART from last week in a different guise: agent safety is a property of the whole assembled system, not of its parts checked separately.
- The practical implication is uncomfortable, because checking every combination of skills in a large library is combinatorially impossible — which means the fix has to be runtime enforcement rather than pre-approval.