CoSA Attack: Hidden Permission Escalation Risks in LLM Agent Skill Combinations

LLM Agents extend their capabilities by composing reusable Agent Skills, but checking the compliance of each Skill individually does not guarantee they remain safe when combined. A new paper names this failure mode Conflict of Skills (CoS): an artifact or evaluation signal generated for one purpose may, when reused downstream, fail to preserve the restrictions or authorizations required by the new purpose. Based on this finding, the researchers propose the Conflict of Skills Attack (CoSA)—without modifying existing Skills or runtime permissions, adding a small number of "locally admitted" new Skills to the skill pool can significantly drive up the policy violation rate.

Four Recurring Mechanisms of CoS

By executing publicly available Skills under controlled conditions and comparing them against matched single-Skill control groups, the researchers identified four recurring mechanisms behind CoS. What these mechanisms share is that each Skill is individually compliant, yet the dependency relationships between them create new information flows and authorization gaps when composed.

Simply put, the problem is not that any single Skill has a vulnerability, but that the act of "composition" itself is not covered by existing inspection methods. When an Agent autonomously selects and chains Skills, an artifact produced by one Skill may be consumed directly as trusted input by another Skill, and the latter does not carry the former's original usage restrictions.

Agent Skills are reusable capability encapsulation units in the LLM Agent ecosystem, typically defined in the form of declarative configuration or lightweight code that specifies the execution logic, required tools, and permission scope for a particular task. At runtime, an Agent can autonomously select and chain several Skills according to the task goal, forming an execution chain. This design greatly enhances the flexibility and extensibility of Agents, but it also means that a single Skill's compliance declarations (such as "may only read a certain directory" or "may not initiate external requests") can be bypassed or amplified by other Skills in composition scenarios. Understanding the "composability" of Skills is a prerequisite for understanding CoS: composition itself creates new information flow paths, while existing auditing tools often only perform static checks on individual Skills and cannot capture dynamic cross-Skill dependencies.

How CoSA Launches Attacks

The core idea of CoSA is "capability supplementation" and "relationship reshaping." The attacker adds locally admitted Skills to the existing skill pool to fill in missing business operations (capability supplementation), or to alter artifact exchange, decision reuse, and goal/action binding (relationship reshaping).

What makes this attack stealthy is that it does not touch existing Skills or change runtime permissions, so traditional permission audits can hardly detect anomalies. The newly added Skills may appear harmless individually, but the cross-Skill dependencies they form with existing Skills are the bridge that turns compliance into violation.

Runtime permissions refer to the system-level or application-level operation permits granted to an Agent during execution, such as file read/write, network access, and API call scope. The traditional security model assumes that as long as runtime permissions are strictly limited, the Agent's behavior will not go out of bounds. However, CoSA reveals a key blind spot—an attacker does not need to elevate or tamper with runtime permissions; they only need to introduce a new Skill into the skill pool and exploit its legitimate interaction paths with existing Skills to make the Agent perform operations that should be prohibited within its existing permissions. This is because permission checks usually target individual actions or individual Skills rather than cross-Skill information flows and authorization transfer. Therefore, the "static compliance" of runtime permissions does not equal "compositional safety," and dynamic, cross-boundary authorization verification mechanisms are needed.

CoSA-Bench: Quantitative Evaluation in Real-World Scenarios

To evaluate this threat under conditions of autonomous skill selection, the researchers built CoSA-Bench, based on real-world Skills and controlled services, covering four major domains—recruitment, finance, IT, and business—with a total of 288 tasks involving three types of risk: data leakage, unauthorized state modification, and unsafe execution.

Tests across five LLMs and three Agent harnesses showed that with newly added Skills capped at only 5% of each original pool, the policy violation rate rose from 35.02% to 58.45%, an increase of 23.43 percentage points. Trajectory analysis clearly links the shift from compliance to violation to cross-Skill dependencies involving the newly added Skills.

This data shows that the attack surface does not need to be large—just a small number of carefully designed new Skills can pry open the security boundary of the entire Agent ecosystem.

Lightweight Defense: A Harness-Level Guard

Finally, the researchers developed a lightweight harness-level guard that checks information flows and authorization before executing consequential actions. On OpenClaw^Ad recruitment tasks, across five models, the guard reduced the violation rate from 65.28% to 6.67%; on a matched benign control group, the compliant task completion rate went from 66.67% to 65.00%, with almost no loss.

This set of comparative data is quite convincing: security hardening does not have to come at the expense of task completion. Placing checks at the harness layer rather than the individual Skill layer directly addresses the root cause of CoS—compositional relationships.

Implications for the Agent Ecosystem

The problem revealed by CoSA is universal: any Agent ecosystem that supports the reuse and composition of third-party Skills may face similar cross-skill conflicts. The approach of single-point compliance checking needs to be upgraded to information flow and authorization verification at the composition level.

For teams building Agent platforms, this means skill admission cannot rely solely on the declarations of an individual Skill; it must also examine the dependency paths it may form with existing Skills in the pool. The effectiveness of the lightweight guard at the harness layer also provides a reference direction for engineering implementation.

One-line Summary

A new paper reveals the Conflict of Skills (CoS) in LLM Agent skill composition and proposes the CoSA attack and a harness-level defense.

Paragraph Summary

The paper proposes the concept of Conflict of Skills (CoS), pointing out that individual Agent Skills may be compliant yet produce permission escalation when combined, and identifies four recurring mechanisms. Based on this, the researchers design the Conflict of Skills Attack (CoSA), which adds no more than 5% locally admitted new Skills to the skill pool to achieve capability supplementation or relationship reshaping, significantly increasing the policy violation rate without modifying existing Skills or runtime permissions. To quantify the threat, they build CoSA-Bench covering 288 tasks across four domains; tests across five LLMs and three harnesses show the violation rate rising from 35.02% to 58.45%. Finally, they propose a lightweight harness-level guard that reduces the violation rate from 65.28% to 6.67% on OpenClaw recruitment tasks with almost no change in benign task completion, providing an actionable defense direction for Agent ecosystem security.