CoRedSkill: Stealthy Skill Composition Attacks via AST-Guided Injection
CoRedSkill’s composed agent skills hit 98% attack success and only 3.3% audit detection.
CoRedSkill is a compositional red-teaming method that hides attacks inside cooperating agent skills while keeping the original task useful. It decomposes a workflow, rewrites task functions with abstract-syntax-tree injection, and uses skill instructions plus intermediate artifacts so the agent connects the operations at runtime. On 150 cases covering 50 tasks and three objectives, it reached 98.0% attack success and 95.3% task success with a 3.3% audit detection rate, and 90.7% joint success versus 6.7–42.7% for four baselines.
- CoRedSkill splits a workflow into cooperating skills and injects attacks via AST rewriting.
- Instructions steer the agent to select and invoke the malicious skills.
- Main results: 98.0% attack success, 95.3% task success, and 3.3% detection.
- Joint success was 90.7%, versus 6.7–42.7% for four baselines.
- The benchmark has 150 cases across 50 tasks and three objectives.
Full article189 words · extracted from arxiv.org · click to collapse
Agents extend their capabilities through reusable skills that package instructions, executable code, and resources. Composing these skills enables complex task workflows, but their dependencies can also connect malicious operations across skills, making their combined intent difficult to identify through individual-package auditing. We introduce CoRedSkill, a compositional red-teaming method that forms stealthy attacks through cooperating skills while preserving their original utility. CoRedSkill decomposes an existing workflow into interdependent skills and embeds attack operations in task functions through abstract syntax tree (AST) rewriting, with skill instructions guiding the agent to autonomously select and invoke the relevant skills, and workflow dependencies and intermediate artifacts connecting the injected operations during task execution. We construct a benchmark of 150 cases covering 50 tasks and three attack objectives to evaluate attack success, task completion, and audit detection. In the main evaluation, CoRedSkill achieves 98.0% attack success and 95.3% task success with a 3.3% detection rate, and a joint success rate of 90.7% (attack success, task completion, and audit evasion in the same case) compared with 6.7--42.7% for the four baselines. Skill compositions can therefore complete legitimate tasks while carrying out unauthorized operations that evade auditing.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2610.20049