这篇论文讲了一个新攻击思路：把恶意技能拆成多个看似无害的小技能，组合起来就能绕过扫描器。还给了防御方案ChainGuard，做智能体安全的人值得看看。
ColluSkill是一种针对LLM智能体技能扫描器的对抗性攻击框架，通过将恶意意图分解为多个独立包装的技能子负载，利用上下文依赖和工件传递在运行时组合成有害工作流。实验显示，在六个代表性技能扫描器上，ColluSkill平均攻击成功率达96.0%，显著优于单技能和多技能攻击基线。为防御此类攻击，研究者提出ChainGuard，一种上下文感知的技能链扫描器，通过重建跨技能依赖和工件流将攻击成功率降至22.5%，同时允许99.5%良性工作流通过。该研究揭示了现有技能扫描器仅检查单个技能的安全盲区，强调链级安全分析对智能体技能生态系统的重要性。
ColluSkill: Adversarial Cross-Skill Composition for Evading Agent Skill Scanners
Agent skills are emerging as an important attack surface in LLM-based agent systems. Through an empirical study of existing skill scanners, we find that current defenses mainly inspect individual skills, leaving risks from cross-skill composition insufficiently examined. This creates a practical blind spot: multiple locally plausible skills may pass security checks while collectively forming a harmful workflow during agent execution. To investigate this threat, we propose ColluSkill, a collusive multi-skill-chain attack framework that decomposes a complete malicious intent into interdependent sub-payloads embedded in independently packaged skills. The attack does not rely on any single malicious skill, but emerges from the ordered composition of locally plausible behaviors through contextual dependencies, artifact passing, and execution handoffs. ColluSkill further employs LLM-based chain planning and scanner-feedback refinement to preserve chain-level attack semantics while reducing suspicious signals in individual sub-skills. To defend against such attacks, we propose ChainGuard, a context-aware skill-chain scanner that jointly analyzes a candidate skill and the skills already installed in the agent environment. ChainGuard reconstructs cross-skill dependencies, artifact flows, capability compositions, and downstream behaviors to identify risks that emerge only at the workflow level. Experiments on six representative skill scanners show that ColluSkill achieves an average attack success rate of 96.0% and consistently outperforms the evaluated single-skill and multi-skill attack baselines. Meanwhile, ChainGuard reduces the attack success rate to 22.5% while allowing 99.5% of benign workflows to pass, highlighting the importance of chain-level security analysis for agent skill ecosystems.