CoSA 攻击：向 Agent 技能池加 5% 技能，违规率从 35% 升至 58%
CoSA: The Conflict of Skills Attack in Real-World LLM Agent Ecosystems
只往技能池塞 5% 新技能，违规率就从 35% 飙到 58%，做 agent 技能生态的都得看看，论文还附带了能降到 6.67% 的防护方案。
论文提出 Conflict of Skills（CoS）问题：单个 Skill 各自合规，组合使用时却可能违反策略。作者构建 CoSA 攻击，只需向现有技能池添加不超过 5% 的新技能，就能通过能力补充或关系重塑引发违规。在自建基准 CoSA-Bench 的 288 个任务上，覆盖招聘、金融、IT、商业四类场景，五个 LLM 和三种 agent 框架的策略违规率从 35.02% 升至 58.45%。作者还开发了一个在执行前检查信息流与授权的 harness 级防护，在 OpenClaw 招聘任务上把五个模型的违规率从 65.28% 降到 6.67%。
CoSA: The Conflict of Skills Attack in Real-World LLM Agent Ecosystems
Agent Skills allow LLM agents to combine reusable capabilities, but checking each Skill in isolation cannot rule out policy violations when they are composed. We term such failures Conflict of Skills (CoS): artifacts or assessment signals produced for one purpose may be reused downstream without preserving the restrictions or authorization needed for their new use. Using controlled executions of publicly available Skills and matched single-Skill controls, we identify four recurring mechanisms behind CoS. Building on these findings, we introduce the Conflict of Skills Attack (CoSA), which adds locally admitted Skills to an existing pool to supply missing business operations (capability supplementation) or reshape artifact exchange, decision reuse, and target/action bindings (relationship reshaping). CoSA leaves existing Skills and runtime permissions unchanged. To evaluate this threat under autonomous Skill selection, we introduce CoSA-Bench, built from real-world Skills and controlled services, with 288 tasks across recruiting, finance, IT, and business, covering data leakage, unauthorized state modification, and unsafe execution. Across five LLMs and three agent harnesses, additions capped at 5% of each original pool raise the policy-violation rate from 35.02% to 58.45%, an increase of 23.43 percentage points. Trace analysis links compliant-to-violating transitions to cross-Skill dependencies involving the additions. Finally, we develop a lightweight harness-level guard that checks information flow and authorization before consequential actions. On OpenClaw recruiting tasks across five models, the guard reduces violations from 65.28% to 6.67%, while policy-compliant task completion on matched benign controls changes from 66.67% to 65.00%.
