CoRedSkill: Stealthy Skill Composition Attacks via AST-Guided Injection
Agent ecosystems rely on reusable skills that compose into complex workflows. CoRedSkill decomposes a legitimate workflow into interdependent skills and injects distributed attack operations via AST rewriting, preserving original utility while connecting malicious steps through intermediate artifacts. On a 150-case benchmark spanning exfiltration, tampering, and privilege violation, it achieves 98.0% attack success and 90.7% joint success against both skill-package and runtime auditors. The work exposes a severe gap: skill compositions can simultaneously complete legitimate tasks and carry out stealthy unauthorized operations.
CoRedSkill is a technically creative red-teaming method that effectively demonstrates the risk of distributed, utility-preserving attacks across skill compositions. The core mechanism—AST rewriting guided by stage specifications—provides a concrete procedure for embedding operations without breaking task logic. However, the evaluation is confined to a custom offline benchmark with synthetic inputs and a single execution per case, which tempers the strength of the headline 90.7% joint success claim.
The AST-guided injection procedure is the strongest contribution. By anchoring rewrites to existing helper functions and preserving caller interfaces, the method plausibly maintains compatibility with agent invocation. The benchmark design is also commendable: pairing 50 tasks with three attack objectives and measuring joint success via $JSR=\frac{1}{N}\sum_{n=1}^{N}A_{n}U_{n}(1-D_{n})$ captures the multi-objective nature of the problem better than isolated metrics.
The primary concern is external validity. All 150 cases use offline fixtures, simulated services, and synthetic data, and each case is run only once. The paper acknowledges this in its limitations, noting that 'dynamic service interactions or long-term operation' are not evaluated.
A second concern is baseline fairness: SCR-Bench is adapted from a two-skill capability-flow setting to the benchmark's tasks using 'fixed prompt-injection templates,' which may not represent its intended usage. Third, composition-aware auditing raises the detection rate to 28.7% (74.0% for EXF), indicating that the attack's stealth degrades meaningfully when auditors review all constituent skills together, yet the abstract and introduction downplay this adaptive scenario.
The empirical evidence supports the claim that CoRedSkill outperforms the four baselines on the benchmark, but the comparison hinges on adaptations that are not equally suited to the setting. ColluSkill suffers from low utility because it 'focuses on constructing attack payloads and evading audits, without consistently preserving skill utility,' which explains its low TSR. SCR-Bench uses 'fixed templates with limited task functionality,' handicapping it on these tasks. SkillJect achieves high ASR/TSR but is detected far more often under LLM-based skill auditing. While the relative performance trends are consistent across auditors, the evidence does not establish that CoRedSkill would generalize to real-world skills beyond the curated 50-task set.
Reproducing the experiments would be difficult. The paper omits the exact system prompts, decomposition instructions, and AST replacement templates used by the construction model, stating only that DeepSeek V4 Flash performs workflow decomposition and attack construction. Each case is executed once, so variance from stochastic LLM agents is unreported. The authors pledge to release 'sanitized execution traces, synthetic inputs, and the evaluation harness,' but not the malicious skill packages or the decomposition implementation, which blocks independent end-to-end reproduction. Additionally, the platform—Claude Code CLI version 2.1.92 with deepseek-v4-flash—includes components that may not be publicly available or version-pinned.
Agents extend their capabilities through reusable skills that package instructions, executable code, and resources. Composing these skills enables complex task workflows, but their dependencies can also connect malicious operations across skills, making their combined intent difficult to identify through individual-package auditing. We introduce CoRedSkill, a compositional red-teaming method that forms stealthy attacks through cooperating skills while preserving their original utility. CoRedSkill decomposes an existing workflow into interdependent skills and embeds attack operations in task functions through abstract syntax tree (AST) rewriting, with skill instructions guiding the agent to autonomously select and invoke the relevant skills, and workflow dependencies and intermediate artifacts connecting the injected operations during task execution. We construct a benchmark of 150 cases covering 50 tasks and three attack objectives to evaluate attack success, task completion, and audit detection. In the main evaluation, CoRedSkill achieves 98.0% attack success and 95.3% task success with a 3.3% detection rate, and a joint success rate of 90.7% (attack success, task completion, and audit evasion in the same case) compared with 6.7--42.7% for the four baselines. Skill compositions can therefore complete legitimate tasks while carrying out unauthorized operations that evade auditing.
Pick a starting point or write your own. Challenges run in the background, so you can keep reading while the AI investigates.
No challenges yet. Disagree with the review? Ask the AI to revisit a specific claim.