单独通过检测的AI技能组合后可能引发安全风险，该研究揭示了这一隐患并提出新攻击框架。
CompoSkill: Compositional Skill Chain Attacks from Individually Scanner-Passing LLM Agent Skills
- 构建双模式攻击系统，模拟白盒与黑盒环境下技能组合攻击
- 在白盒/黑盒设置下实现最高83.3%/80.6%的风险链生成率
- 发现三跳后攻击成功率下降，提示风险传播存在阈值
自主AI代理执行长时序任务依赖于一个个独立认证的技能。现有扫描器仅检查单个技能是否通过，认为只要每个技能达标，整个生态就安全。本文揭示：这种假设在技能组合时失效——一个技能虽单独通过扫描，但与其他通过扫描的技能组合后可能产生风险。风险是路径级属性而非节点级，导致现有扫描器拦截能力有限。为此，提出CompoSkill框架，包含白盒（知悉技能池）与黑盒（仅知角色描述）攻击者，分别注入显式技能序列或隐式高危链。构建CompoSkill-Bench基准，涵盖5类威胁、6种场景下的1,140条长时序专业工作流数据，基于OpenClaw与Nanobot平台。实验显示，白盒/黑盒下风险链生成率分别达83.3%与80.6%，而现有扫描器仅能拦截部分风险组合。进一步发现‘桥接技能增益，三跳后衰减’规律：桥接技能提升成功率，但超过三跳后攻击成功率（ASR）下降。研究暴露了单一技能认证在自主代理中的系统性缺陷。
原文摘要 · Abstract (English)
Autonomous AI agents tackling Long Horizon Tasks depend on marketplace skills that are certified one at a time: a scanner returns a safety verdict for each skill and declares the ecosystem safe if every package passes. We show that this assumption fails under skill composition. A skill may pass the per-skill scanner individually yet participate in a risky composition when an agent connects its outputs, capabilities, or side effects with those of other scanner-passing skills. This makes skill composition risk a path level property rather than a node level property, explaining why existing skill scanners that inspect individual packages achieve limited interception. To study this threat, we present CompoSkill, a framework that constructs skill composition attacks through a dual attacker system. The white-box attacker knows the victim's installed skill pool and directly injects explicit skill-id sequences; the black-box attacker knows only a role profile, downloads the top marketplace skills for that scenario, builds a Skill Composition Graph, and searches for high risk chains whose implicit lures never name skill identifiers. We further construct CompoSkill-Bench, a benchmark of 1,140 records built from long-horizon professional workflows across five threats and six scenarios on OpenClaw and Nanobot. CompoSkill achieves risk Chain Formation Rates (CFR) up to 83.3% in the white box setting and 80.6% in the black box setting, while existing skill scanners block only a limited fraction of the risky compositions. Finally, we observe a bridge-bonus-then-hop-decay pattern: a bridge skill can increase attack success, but Attack Success Rate (ASR) decreases once additional hops make the risk chain longer than three skills. These results expose a systematic gap in single skill certification for autonomous AI agents.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。