CoRedSkill: Stealthy Skill Composition Attacks via AST-Guided Injection
CoRedSkill is a red-teaming method for agent “skill” ecosystems that hides malicious behavior across multiple otherwise useful skills by AST-rewriting their task functions and relying on normal workflow dependencies and intermediate artifacts to stitch the attack together at runtime. The interesting bit is that it targets the composition layer rather than single packages, showing very high attack and task-success with low audit detection in its benchmark, though the evidence is limited to 150 constructed cases and the abstract leaves open how well this transfers to messier real-world skill repositories and stronger dynamic auditing.
Abstract
Agents extend their capabilities through reusable skills that package instructions, executable code, and resources. Composing these skills enables complex task workflows, but their dependencies can also connect malicious operations across skills, making their combined intent difficult to identify through individual-package auditing. We introduce CoRedSkill, a compositional red-teaming method that forms stealthy attacks through cooperating skills while preserving their original utility. CoRedSkill decomposes an existing workflow into interdependent skills and embeds attack operations in task functions through abstract syntax tree (AST) rewriting, with skill instructions guiding the agent to autonomously select and invoke the relevant skills, and workflow dependencies and intermediate artifacts connecting the injected operations during task execution. We construct a benchmark of 150 cases covering 50 tasks and three attack objectives to evaluate attack success, task completion, and audit detection. In the main evaluation, CoRedSkill achieves 98.0% attack success and 95.3% task success with a 3.3% detection rate, and a joint success rate of 90.7% (attack success, task completion, and audit evasion in the same case) compared with 6.7--42.7% for the four baselines. Skill compositions can therefore complete legitimate tasks while carrying out unauthorized operations that evade auditing.