KnotScryer finds 612 risky chains among clean agent skills
Original title: Detecting Insecure Compositions of Clean Agent Skills via Capability-Flow Graph Analysis
On 13,598 ClawHub skills, 13.7% of flagged chains were made only of skills a single-skill scanner labeled safe.
The paper says individually clean third-party agent skills can form safety-violation chains when an agent passes one skill's output to another. KnotScryer models skills as typed capability flows, builds a Skill Capability-Flow Graph, and checks candidate paths with replay plus an LLM chain audit. Applied to 13,598 clean skills from ClawHub, it found 612 insecure compositions that the authors say were consistently reproduced across three agent frameworks and three LLMs. Under GLM-5.1, reported exploitation rose from 16.5%-18.2% for baselines to 85.6%, while the search space fell 85.3%.
Unconfirmed: Reported exploitation rates come from the authors' lab validation, not confirmed external attacks.
- KnotScryer analyzed 13,598 clean skills from ClawHub.
- It reported 612 compositions reproduced across three frameworks and three LLMs.
- Under GLM-5.1, exploitation rose to 85.6% from 16.5%-18.2% for baselines.
- The search space was reduced by 85.3% versus the baselines.
- 13.7% of chains used only skills marked safe by a single-skill scanner.
Impact: Benign skills can chain into safety-violating agent actions
| Product | Affected |
|---|---|
| ClawHub agent skills | 13,598 clean skills analyzed |
- 1.Review multi-skill agent workflows, not only individual skill labels.
- Products
- KnotScryerClawHub
- AI models
- GLM-5.1
From the original article
1 min read at arxiv.orgAI agents increasingly extend their capabilities by invoking third-party skills, where each skill encapsulates instructions, scripts, and resources for agents to execute on demand.
By Yihao Li · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.