{"id":"https://openalex.org/W7202204237","doi":"https://doi.org/10.48550/arxiv.2608.09732","title":"ColluSkill: Adversarial Cross-Skill Composition for Evading Agent Skill Scanners","display_name":"ColluSkill: Adversarial Cross-Skill Composition for Evading Agent Skill Scanners","publication_year":2026,"publication_date":"2026-08-10","ids":{"openalex":"https://openalex.org/W7202204237","doi":"https://doi.org/10.48550/arxiv.2608.09732"},"language":"en","primary_location":{"id":"pmh:oai:arXiv.org:2608.09732","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2608.09732","pdf_url":"https://arxiv.org/pdf/2608.09732","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"volume":null,"type":"preprint","indexed_in":["arxiv","datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/2608.09732","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5146510403","display_name":"Puyu Zeng","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I205237279","display_name":"Nankai University","ror":"https://ror.org/01y1kjr75","country_code":"CN","type":"education","lineage":["https://openalex.org/I205237279"]},{"id":"https://openalex.org/I4210132990","display_name":"State Key Laboratory of Cryptology","ror":"https://ror.org/02pn5rj08","country_code":"CN","type":"government","lineage":["https://openalex.org/I4210132990"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zeng, Puyu","raw_affiliation_strings":["College of Cryptology and Cyber Science , Nankai University , China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"College of Cryptology and Cyber Science , Nankai University , China","institution_ids":["https://openalex.org/I205237279","https://openalex.org/I4210132990"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5129981276","display_name":"Simeng Qin","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I9224756","display_name":"Northeastern University","ror":"https://ror.org/03awzbc87","country_code":"CN","type":"education","lineage":["https://openalex.org/I9224756"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Qin, Simeng","raw_affiliation_strings":["Northeastern University , China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Northeastern University , China","institution_ids":["https://openalex.org/I9224756"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5146463252","display_name":"Jingzhi Li","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I92403157","display_name":"University of Science and Technology Beijing","ror":"https://ror.org/02egmk993","country_code":"CN","type":"education","lineage":["https://openalex.org/I92403157"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Li, Jingzhi","raw_affiliation_strings":["University of Science and Technology Beijing , China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Science and Technology Beijing , China","institution_ids":["https://openalex.org/I92403157"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5146555887","display_name":"Ju Jia","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I76569877","display_name":"Southeast University","ror":"https://ror.org/04ct4d772","country_code":"CN","type":"education","lineage":["https://openalex.org/I76569877"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jia, Ju","raw_affiliation_strings":["Southeast University , China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Southeast University , China","institution_ids":["https://openalex.org/I76569877"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5146554244","display_name":"Zheli Liu","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I205237279","display_name":"Nankai University","ror":"https://ror.org/01y1kjr75","country_code":"CN","type":"education","lineage":["https://openalex.org/I205237279"]},{"id":"https://openalex.org/I4210132990","display_name":"State Key Laboratory of Cryptology","ror":"https://ror.org/02pn5rj08","country_code":"CN","type":"government","lineage":["https://openalex.org/I4210132990"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Liu, Zheli","raw_affiliation_strings":["College of Cryptology and Cyber Science , Nankai University , China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"College of Cryptology and Cyber Science , Nankai University , China","institution_ids":["https://openalex.org/I205237279","https://openalex.org/I4210132990"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5126268550","display_name":"Xiaojun Jia","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I172675005","display_name":"Nanyang Technological University","ror":"https://ror.org/02e7b5302","country_code":"SG","type":"education","lineage":["https://openalex.org/I172675005"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"Jia, Xiaojun","raw_affiliation_strings":["Nanyang Technological University , Singapore"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Nanyang Technological University , Singapore","institution_ids":["https://openalex.org/I172675005"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":6,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9916999936103821,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9916999936103821,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.005400000140070915,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.0007999999797903001,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/llm-based-agents","display_name":"LLM agents","score":0.7749999761581421},{"id":"https://openalex.org/keywords/adversarial-attacks","display_name":"adversarial attacks","score":0.5529999732971191},{"id":"https://openalex.org/keywords/llm-agent-security","display_name":"LLM agent security","score":0.4950000047683716}],"concepts":[{"id":"https://openalex.org/C177212765","wikidata":"https://www.wikidata.org/wiki/Q627335","display_name":"Workflow","level":2,"score":0.7563999891281128},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.729200005531311},{"id":"https://openalex.org/C2779010991","wikidata":"https://www.wikidata.org/wiki/Q2720909","display_name":"Artifact (error)","level":2,"score":0.6662999987602234},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.5697000026702881},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5218999981880188},{"id":"https://openalex.org/C185874996","wikidata":"https://www.wikidata.org/wiki/Q269699","display_name":"Interdependence","level":2,"score":0.5156000256538391},{"id":"https://openalex.org/C184337299","wikidata":"https://www.wikidata.org/wiki/Q1437428","display_name":"Semantics (computer science)","level":2,"score":0.41290000081062317},{"id":"https://openalex.org/C40231798","wikidata":"https://www.wikidata.org/wiki/Q1333743","display_name":"Composition (language)","level":2,"score":0.3878999948501587},{"id":"https://openalex.org/C165064840","wikidata":"https://www.wikidata.org/wiki/Q1321061","display_name":"Matching (statistics)","level":2,"score":0.3686000108718872},{"id":"https://openalex.org/C2776576444","wikidata":"https://www.wikidata.org/wiki/Q303569","display_name":"Attack surface","level":2,"score":0.35260000824928284},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.336899995803833},{"id":"https://openalex.org/C2776436953","wikidata":"https://www.wikidata.org/wiki/Q5163215","display_name":"Consistency (knowledge bases)","level":2,"score":0.3359000086784363},{"id":"https://openalex.org/C107457646","wikidata":"https://www.wikidata.org/wiki/Q207434","display_name":"Human\u2013computer interaction","level":1,"score":0.334199994802475},{"id":"https://openalex.org/C166052673","wikidata":"https://www.wikidata.org/wiki/Q83021","display_name":"Empirical evidence","level":2,"score":0.33070001006126404},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.2989000082015991},{"id":"https://openalex.org/C140547941","wikidata":"https://www.wikidata.org/wiki/Q7797194","display_name":"Threat model","level":2,"score":0.29760000109672546},{"id":"https://openalex.org/C168167062","wikidata":"https://www.wikidata.org/wiki/Q1117970","display_name":"Component (thermodynamics)","level":2,"score":0.28060001134872437}],"mesh":[],"locations_count":2,"locations":[{"id":"pmh:oai:arXiv.org:2608.09732","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2608.09732","pdf_url":"https://arxiv.org/pdf/2608.09732","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"doi:10.48550/arxiv.2608.09732","doi":"https://doi.org/10.48550/arxiv.2608.09732","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2608.09732","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:2608.09732","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2608.09732","pdf_url":"https://arxiv.org/pdf/2608.09732","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7202204237.pdf","grobid_xml":"https://content.openalex.org/works/W7202204237.grobid-xml"},"referenced_works_count":0,"referenced_works":[],"related_works":["https://openalex.org/W7203705983","https://openalex.org/W7167253155","https://openalex.org/W7214655778","https://openalex.org/W7151909507","https://openalex.org/W7215058434","https://openalex.org/W7164930602","https://openalex.org/W7164973340","https://openalex.org/W7216211637","https://openalex.org/W7223064464","https://openalex.org/W7165612482"],"abstract_inverted_index":{"Agent":[0],"skills":[1,46,155],"are":[2],"emerging":[3],"as":[4],"an":[5,14,193],"important":[6],"attack":[7,70,87,126,195,208,214],"surface":[8],"in":[9,82,132,158],"LLM-based":[10,117],"agent":[11,58,160,235],"systems.":[12],"Through":[13],"empirical":[15],"study":[16],"of":[17,102,198,222,230],"existing":[18],"skill":[19,152,187,236],"scanners,":[20],"we":[21,64,140],"find":[22],"that":[23,72,147,176,190],"current":[24],"defenses":[25],"mainly":[26],"inspect":[27],"individual":[28,133],"skills,":[29],"leaving":[30],"risks":[31,175],"from":[32,98],"cross-skill":[33,164],"composition":[34,101],"insufficiently":[35],"examined.":[36],"This":[37],"creates":[38],"a":[39,54,67,74,143,150],"practical":[40],"blind":[41],"spot:":[42],"multiple":[43],"locally":[44,103],"plausible":[45,104],"may":[47],"pass":[48],"security":[49,232],"checks":[50],"while":[51,128,219],"collectively":[52],"forming":[53],"harmful":[55],"workflow":[56,181],"during":[57],"execution.":[59],"To":[60,135],"investigate":[61],"this":[62],"threat,":[63],"propose":[65,141],"ColluSkill,":[66],"collusive":[68],"multi-skill-chain":[69],"framework":[71],"decomposes":[73],"complete":[75],"malicious":[76,94],"intent":[77],"into":[78],"interdependent":[79],"sub-payloads":[80],"embedded":[81],"independently":[83],"packaged":[84],"skills.":[85],"The":[86],"does":[88],"not":[89],"rely":[90],"on":[91,184],"any":[92],"single":[93],"skill,":[95],"but":[96],"emerges":[97],"the":[99,154,159,180,203,213,228],"ordered":[100],"behaviors":[105,172],"through":[106],"contextual":[107],"dependencies,":[108,165],"artifact":[109,166],"passing,":[110],"and":[111,120,153,170,200,206],"execution":[112],"handoffs.":[113],"ColluSkill":[114,191],"further":[115],"employs":[116],"chain":[118],"planning":[119],"scanner-feedback":[121],"refinement":[122],"to":[123,173,217,225],"preserve":[124],"chain-level":[125,231],"semantics":[127],"reducing":[129],"suspicious":[130],"signals":[131],"sub-skills.":[134],"defend":[136],"against":[137],"such":[138],"attacks,":[139],"ChainGuard,":[142],"context-aware":[144],"skill-chain":[145],"scanner":[146],"jointly":[148],"analyzes":[149],"candidate":[151],"already":[156],"installed":[157],"environment.":[161],"ChainGuard":[162,211],"reconstructs":[163],"flows,":[167],"capability":[168],"compositions,":[169],"downstream":[171],"identify":[174],"emerge":[177],"only":[178],"at":[179],"level.":[182],"Experiments":[183],"six":[185],"representative":[186],"scanners":[188],"show":[189],"achieves":[192],"average":[194],"success":[196,215],"rate":[197,216],"96.0%":[199],"consistently":[201],"outperforms":[202],"evaluated":[204],"single-skill":[205],"multi-skill":[207],"baselines.":[209],"Meanwhile,":[210],"reduces":[212],"22.5%":[218],"allowing":[220],"99.5%":[221],"benign":[223],"workflows":[224],"pass,":[226],"highlighting":[227],"importance":[229],"analysis":[233],"for":[234],"ecosystems.":[237]},"counts_by_year":[],"updated_date":"2026-10-28T10:33:24.094632","created_date":"2026-08-12T00:00:00"}