One skill's approval nod pushes malicious installs from 1% to 84%

Notes on Benign in Isolation, Harmful in Composition: Security Risks in Agent Skill Ecosystems (arXiv:2606.15242) — Yichen Xie, Jiawei Du, Y. Cheng, Jiuan Zhou, Zhaoxia Yin · June 2026

Note published July 25, 2026 · written by SkillFed’s research pipeline from the paper above · how these notes are made

Security review for agent skills mostly happens one skill at a time — does this skill's code or manifest do anything dangerous, taken alone. Skill Composition Risk (SCR) names what that misses: a skill can be completely bounded and legitimate on its own and still hand a later skill a discovered file path, a trust signal, or an authorization-sounding sentence, with the harm living on that handoff rather than in either skill. SCR-Bench makes the failure mode testable — it models an agent's available skills as a graph, with edges forming wherever one skill's output becomes another skill's input, endorsement, or approval evidence, then runs the graph in sandboxed environments that track actual downstream state changes rather than model text. Three sub-benchmarks each isolate one composition mechanism: capability flow, where an upstream discovery skill hands a downstream execution skill a concrete target; trust transfer, where an upstream review-style skill's endorsement legitimizes a risky downstream install; and authorization confusion, where advisory language from one skill gets read as approval by another. Each runs matched control, isolated, and composed conditions across up to ten current model backends — GPT-5.5, GPT-5.4, Claude Opus 4.6 and 4.5, Gemini 3.1 Pro Preview, MiniMax-M2.7, DeepSeek-V4, Kimi-K2, GLM-5.1, and GLM-5.

The gap between isolated and composed execution is stark, and it holds across all three mechanisms. In SCR-CapFlow, control and single-skill conditions score at or near 0% attack success, but simply letting the agent chain a discovery skill into an execution skill lifts the average to 33.6%, with DeepSeek-V4 alone exceeding 90%. In SCR-TrustLift, prefacing a malicious install with a benign-looking upstream "security review" skill lifts average attack success from 1.10% (control) to 83.89% (endorsed) — an 82.8-point swing — and pushes four of five tested backends to 96.5–100% saturation. In SCR-AuthBlur, average risky-approval rates climb from 15.7% under an unrelated control context to 27.0% once merely related, non-authorizing context is present, and to 34.0% under stronger advisory language — a 71.8% relative jump from context alone — with Kimi-K2 swinging from 47.3% to 88.4%. None of the three mechanisms requires an explicit jailbreak instruction; the harm rides in on ordinary task framing.