CoSA: The Conflict of Skills Attack in Real-World LLM Agent Ecosystems

Agent Skills allow LLM agents to combine reusable capabilities, but checking each Skill in isolation cannot rule out policy violations when they are composed. We term such failures Conflict of Skills (CoS): artifacts or assessment signals produced for one purpose may be reused downstream without preserving the restrictions or authorization needed for their new use. Using controlled executions of publicly available Skills and matched single-Skill controls, we identify four recurring mechanisms behind CoS. Building on these findings, we introduce the Conflict of Skills Attack (CoSA), which adds locally admitted Skills to an existing pool to supply missing business operations (capability supplementation) or reshape artifact exchange, decision reuse, and target/action bindings (relationship reshaping). CoSA leaves existing Skills and runtime permissions unchanged. To evaluate this threat under autonomous Skill selection, we introduce CoSA-Bench, built from real-world Skills and controlled services, with 288 tasks across recruiting, finance, IT, and business, covering data leakage, unauthorized state modification, and unsafe execution. Across five LLMs and three agent harnesses, additions capped at 5% of each original pool raise the policy-violation rate from 35.02% to 58.45%, an increase of 23.43 percentage points. Trace analysis links compliant-to-violating transitions to cross-Skill dependencies involving the additions. Finally, we develop a lightweight harness-level guard that checks information flow and authorization before consequential actions. On OpenClaw recruiting tasks across five models, the guard reduces violations from 65.28% to 6.67%, while policy-compliant task completion on matched benign controls changes from 66.67% to 65.00%.

Attack success across agent harnesses

The main evaluation compares original and augmented Skill pools under matched requests, initial states, permissions, and execution budgets. Agents select their Skills and invocation order autonomously.

ASR increases in all 15 model–harness combinations. The pooled increase is 23.43 percentage points: 1,513/4,320 original runs and 2,525/4,320 augmented runs violate policy. Differences are computed from unrounded counts.

ASR counts a concrete disclosure, unauthorized persistent mutation, or unauthorized workload start. Generated text and prepared commands alone do not count.

DL: data leakage. UA: unauthorized state modification. UE: unsafe execution.

Five backbones—Qwen3.6, MiniMax-M3, DeepSeek-V4, GPT-5.6, and GLM-5.1—run on OpenClaw, OpenHands, and OpenCode. The grid contains 288 distinct tasks and 8,640 task-runs: one run per task, model, harness, and condition.

Construction and selection both matter

Small additions, fixed execution privileges

The attacker adds domain-relevant Skill packages that pass individual static security checks. Installation is assumed. The maximum augmentation budget is 5% of the original pool, rounded down: two Skills for recruiting and three each for finance, IT, and business.

Original Skills, model, trusted instructions, planner, tools, and runtime permissions remain fixed. Candidate construction uses public domain information and package contracts. Private user data, runtime context, and hidden evaluation policies are unavailable to the attacker.

Evaluation requests and initial states are frozen before candidate generation and selection. “Individually benign” denotes admission under the specified checks, rather than a guarantee of safe runtime behavior.

Threat model: §3.1, pp. 4–5 ↗

When an internal report becomes an external handoff

In the Sofia Alvarez case, auto-context locates materials, 51mee-interview-evaluation-report aggregates interview evidence, and bamboohr-integration submits a partner-facing packet.

The handoff retains internal coordination details, review conclusions, and a compensation-band exception. The backend records posted=true.

The upstream report both preserves restricted content and makes it consumable by the external interface. This is the interaction between security-context attenuation and semantic interface bridging described in Appendix B.3.

This is a deliberately activated discovery case, chosen for interpretability. It does not measure how often the composition occurs naturally.

Case 2: Appendix B.3, pp. 18–19 ↗

Check the boundary before the action

CoSA-Guard is a harness-level patch that checks provenance, release scope, authorization, and target/action bindings before data submission, state mutation, or execution. Only an ALLOW decision reaches the backend.

Across 360 defended attack runs, the paper reports 115 valid blocks, 24 risk successes, and 221 runs with no effective risky action. The false-block rate on benign controls is 12/360 (3.33%). The defense evaluation covers OpenClaw recruiting tasks across five models.

Interpretation and limits

The attack evaluation covers finite domains, models, harnesses, and policy categories. Each condition is evaluated once per task and setting, so the reported ASR is an empirical grid-level rate, rather than a repeated-sampling task probability. The random ablations are descriptive controls.

The defense results distinguish policy violations, valid blocks, and runs with no effective risky action. Benign controls separately measure policy-compliant completion and false blocks. The study evaluates bounded Skill-pool additions with fixed tools and permissions; longer-horizon dependencies and dynamic deployments remain directions for future work.

Defense protocol and counts: Appendix C.3, pp. 21–22 ↗; residual-risk decomposition: Appendix C.4, p. 23 ↗

Cite this manuscript

Cite the arXiv preprint using the official BibTeX below.

@misc{zheng2026cosaconflictskillsattack,
      title={CoSA: The Conflict of Skills Attack in Real-World LLM Agent Ecosystems},
      author={Yujia Zheng and Tianhao Li and Shangzhi Xu and Yuekai Huang and Ziyou Jiang and Zhaoyang Li and Yuyao Ge and Junran Peng and Mingyang Li},
      year={2026},
      eprint={2610.35082},
      archivePrefix={arXiv},
      primaryClass={cs.CL},
      url={https://arxiv.org/abs/2610.35082},
}