Understanding composition attacks on AI Agent ecosystems using skills

Using our FOSS educational lab DVAS (Damn Vulnerable Agent Skills) we will demonstrate how three benign-looking skills - a formatter, a cache, and a logger, can exfiltrate secrets when installed together. Each passes security review in isolation. The attack only emerges when composed.

The formatter silently tags sensitive lines with invisible markers. The cache extracts tagged content. The logger exfiltrates on the next call. No skill looks malicious individually. No single action triggers detection. The chain completes in three normal operations. We will also explain the other primitives of the threat taxonomy of the agent skills:

1. Composition attacks: multi-skill chains that leak only when combined
2. Context poisoning: skills that corrupt agent memory to influence future decisions
3. Privilege creep: status-check skills that silently escalate their own permissions
4. Supply chain squatting: typosquatted packages that steal credentials on install

We'll install skills into a live agent, execute the composition chain, and show secrets leaving the system. Then we'll demonstrate runtime detection, cross-skill data flow monitoring that catches the pattern before exfiltration completes.

takeaways from this session

1. Skills are safe alone, dangerous together

A formatter, cache, and logger can each pass review on their own but installed together they form a chain that exfiltrates secrets in three normal operations. Isolation-based review misses composition attacks because no single skill or action looks malicious.

2. This is a real, reproducible threat, not a thought experiment

The talk promises a live exploit demo showing secrets leaving the system.

3. You can detect and defend at runtime

Cross-skill data flow monitoring catches these patterns before exfiltration finishes.