al-ice.ai

Clean Skills, Dirty Chains: Cross-Session Artifacts and Capability-Flow Composition Turn Benign Skills Into Attacks

AI Security Research by al-ice.ai Editorial

Every skill scanner in production answers one question: is this skill malicious? Two October 2026 papers show why that is the wrong unit of analysis. SkillRelayBench (arXiv:2610.13227, 9 October) demonstrates attacks that cross session boundaries through the files, configurations and cached data one skill leaves behind for the next — reaching 46.7–77.4% attack success across Codex CLI, Gemini CLI and Claude Code. And KnotScryer (arXiv:2610.32155, 23 October) finds 612 insecure compositions among 13,598 individually clean ClawHub skills — chains the authors explicitly compare to return-oriented programming, assembling benign gadgets into a malicious whole. In 13.7% of the detected chains, every component had been labeled safe by a single-skill scanner.

Relay attacks: the filesystem as the second prompt

The SkillRelayBench authors characterize three propagation mechanisms: instruction propagation (malicious effects travel as instructions embedded in artifacts a later skill reads), data-boundary violation (data crosses a trust boundary when a downstream skill consumes an upstream skill’s leftovers), and evidence poisoning (falsified records steer later reasoning). The benchmark is 270 adversarial cases drawn from 30 cross-session composition scenarios across ten domains; evaluation over seven models shows attack-chain success rates of 35.6–61.1%, covering all five target consequence categories. Their defense, SkillRelayGuard, restores artifact provenance context and adds pre-execution advisory review while leaving the final call to the agent — cutting overall attack success from 69.5% to 10.9% (chains from 54.8% to 10.0%) while raising legitimate task completion from 79.6% to 87.5%. The mechanism should feel familiar to readers of this site: session inception smuggled a hook past the guardrail through a child session, and testmetest armed repos to execute through hooks agents read — the relay paper systematizes the same shape into files, configs and cached data persisting across sessions.

Gadget chains: ROP, but the gadgets are skills

KnotScryer attacks the problem statically. Each skill is abstracted into a capability summary; skills become nodes in a Skill Capability-Flow Graph whose edges are cross-skill information flows; a provenance-tracking search follows protected or untrusted data along handoff edges to operations that should never receive it; a two-layer verification replays the flow and applies a task-anchored LLM audit. The threat model is the sobering part: the attacker cannot manipulate user inputs, cannot publish malicious skills, and cannot modify the agent framework — they can only observe what is already public and wait for a victim to install a dangerous combination. Against that weak attacker, 612 chains validated as consistently exploitable across three agent frameworks and three LLMs, beating tag-match and graph-only baselines from 16.5–18.2% to 85.6% exploitation while shrinking the search space 85.3%.

Read together with the 2.2-million-copy lineage census, the implication is uncomfortable: mass reuse plus per-skill auditing equals mass-distributed gadget libraries. And the unpinned-MCP measurement shows the combinations themselves drift over time — a composition judged safe at install month can become unsafe when any component updates. Approving skills one at a time is necessary and no longer sufficient; the approval has to cover the composition, recomputed as the set changes — which is the same conclusion the APM lockfile model reaches from the dependency side.

What to actually do

  1. Extend skill review from single packages to installed sets: model what each skill’s outputs can reach in every other skill’s inputs before approving a combination, and re-check on every update.
  2. Track artifact provenance across sessions — which skill wrote the file, config or cache your agent is about to read — and surface that lineage at execution time, the SkillRelayGuard pattern.
  3. Treat “passed a single-skill scanner” as a hygiene signal, not a safety verdict: 13.7% of KnotScryer’s chains were built entirely from scanner-approved parts.
  4. Constrain the gadget supply: least-privilege skill installation shrinks the composition space an attacker’s observed-public-skills threat model can exploit.

Our verification was read-only. We read the arXiv records and full HTML texts of arXiv:2610.13227 (published 9 October 2026; authors Dianshu Liao, Shidong Pan, Guangdong Bai, Zhenchang Xing, Xiaoyu Sun) and arXiv:2610.32155 (published 23 October 2026; authors Yihao Li, Chuanpu Fu, Yizhou Zhao, Miao Chen, Qi Li, Ke Xu) first-hand: the SkillRelayBench design (270 cases, 30 scenarios, ten domains), the 46.7–77.4% ASR and 35.6–61.1% ACSR ranges, the IP/DBV/EP mechanism taxonomy, the SkillRelayGuard figures (69.5% to 10.9% ASR, 54.8% to 10.0% ACSR, 79.6% to 87.5% completion), the KnotScryer design (SCFG, provenance-aware search, two-layer verification), the 13,598-skill / 612-composition result, the ROP analogy, the 13.7% all-safe composition figure and the GLM-5.1 baseline comparison are the authors’ reported figures. We installed no skills, ran no agent framework and validated no chain. Brave Search was used for discovery only.

Sources: