If you think your agent is secure because every individual skill passed a security scan, think again. A new arXiv preprint, "Detecting Insecure Compositions of Clean Agent Skills via Capability-Flow Graph Analysis" (arXiv 2610.32155), analyzed 13,598 Agent Skills from ClawHub that had been labeled "clean." The result? 612 exploitable chains were found where two or more safe skills, when combined in a single agent, created a vulnerability path. Averaged across nine agent and model setups, 79.2% of these chains successfully executed an attack.

The Worked Example: Inbox and Mailer

The paper’s primary case study involves two mundane skills: outlook-plus (reads inbox) and cold-email-engine (sends email). Individually, neither triggers a security alarm. One reads, the other writes. But when both are installed, a planted phishing email in the inbox instructed the agent to "compile audit-related content" and send it to an attacker's address. The agent complied, leaking sensitive Q3 audit figures. Crucially, when cold-email-engine was uninstalled, the attack failed. The leak required the composition, not the individual components.

Framework Performance and Scanner Blind Spots

The study tested these chains across three frameworks: Hermes v0.16.0, OpenClaw 2026.6.8, and OpenCode v1.17.7. OpenClaw showed the lowest exploitation rate at 71.7%, attributed to its gateway mediation and SSRF protections. However, no framework was immune. More alarming is the failure of existing tools: in 84 of the 612 chains (13.7%), a separate single-skill scanner (Cisco AI Defense) had marked every skill in the chain as safe. This proves that per-skill auditing is structurally incapable of detecting composition risks.

Practical Defense: The Four Shapes of Bad Chains

The researchers identified four primary chain shapes: Data Exfiltration (private data reaching a network sink), Indirect Prompt Injection (untrusted content steering the agent), Code Execution (fetched text running in a shell), and Fact Poisoning (bad data saved to memory). The authors recommend a new mental model for skill installation: treat every new skill as a potential dependency that interacts with existing ones. Keep "reader" skills (those that ingest untrusted content) separate from "sender" skills (those that output data or execute commands).

Key Takeaways

  • Composition is the new attack surface: 612 chains were found among skills deemed 'clean' by marketplace standards.
  • Scanner blindness: 13.7% of exploitable chains consisted entirely of skills that passed individual security audits.
  • Framework matters: OpenClaw's 71.7% exploitation rate was the lowest among tested agents, thanks to gateway mediation.
  • Defense in depth: Isolate skills that read untrusted data from those that send data out, and disable automatic model invocation for high-risk senders.

The Bottom Line

Security is not a property of the skill; it's a property of the system. If you aren't auditing the graph of how your skills interact, you're already leaked.