Agent skill composition turns clean vetting into a false boundary

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Adversa AI's research: Agent skill vetting can fail after approval because clean skills still compose into unsafe behaviour, selection can be steered by metadata, and persistent artifacts can carry risk across sessions.

Why it matters: This matters because IAM and security teams cannot treat agent skill approval as a one-time gate; they need governance for selection, execution, and cross-session carryover as part of the same control surface.

Context

Agent skills are not just bundles of instructions. They can include code, metadata, cached artifacts, and hidden execution paths that change what the agent actually does at runtime. Agent skills security needs to be treated as a governance problem, not only a content-review problem.

The key failure mode is composition. A skill that looks safe on its own can become unsafe when another skill, a later session, or a runtime selector changes the execution context. That makes isolated vetting an incomplete control model for agentic AI programmes.

Key questions

Q: How do you assess agent skill safety beyond single-package scanning?

A: Assess it by reviewing how skills combine, not just whether each package is clean in isolation. A composition-aware review maps each skill’s tools, prompts, data access and side effects across the full agent workflow, then checks for unsafe privilege escalation, hidden data paths, and unexpected actions created by chaining otherwise benign components.

Q: Why do clean AI agent skills still create security risk?

A: Clean agent skills can still create risk because the danger often appears only when they are combined by runtime orchestration. A safe skill may become unsafe if the agent can chain it with another tool, persist state across steps, or use inherited credentials to reach data, systems or actions that no single package exposes alone.

Q: How should teams govern persistent artifacts in agent workflows?

A: Teams should govern persistent artifacts as controlled runtime state, with ownership, scope, retention and deletion rules. That includes files, cached prompts, memory entries, tokens, logs and checkpoints that survive between sessions, because they can carry data, instructions or access context into later agent runs and alter what the agent can see or do.

Q: What is the best way to detect malicious agent skill composition?

A: Detect it by analysing the graph of capabilities, showing which skills, tools, permissions and data paths can be reached together at runtime. The main failure modes are privilege chaining, hidden transitive access and unexpected state carryover, so review the full directed path from trigger to action rather than individual skills alone.

Technical breakdown

Why clean agent skills can still compose into unsafe behaviour

A skill review that checks only the package in front of the reviewer misses the way agents combine capabilities at runtime. The research shows that individually cleared skills can still produce policy violations when chained through handoffs, selection logic, or task sequencing. That is because the behaviour of the system is not the sum of static approvals but the result of runtime orchestration across skills, data, and execution context. In practice, the trust boundary shifts from the package to the graph of interactions between packages. See the Agent Skills Security Guide.

Practical implication: Model skill-to-skill flows as an attack surface and review the composition, not just each skill in isolation.

How metadata and cached artifacts steer agent execution

Agent skill selection can be influenced by more than code. Metadata may affect retrieval and routing, while cached data, files, and generated artifacts can shape what the next session sees and does. In the research, substituted bytecode caches bypassed scanners, and persistent artifacts from one run influenced later sessions. That means the effective security boundary includes what the agent can load, inherit, and reuse, not only what the repository declares. Review has to cover both declared intent and executable or persisted state. See the Low-Code Agent Platform Security Guide.

Practical implication: Treat skill metadata, caches, and persisted outputs as governed inputs to execution, not as harmless by-products.

Why session boundaries do not reset agent risk

Session boundaries only matter if the system forgets what happened before. The research shows the opposite: artifacts left by one skill can propagate into later sessions and alter subsequent agent behaviour, even when the later skill is different. That creates cross-session attack paths in which the initial compromise is not enough to explain the full impact. The technical issue is persistence of influence, not just persistence of files. For governance, the agent’s memory of prior actions becomes part of the control surface. See the Vertex AI Agent Engine security guide.

Practical implication: Audit what survives between sessions and verify that no carried-forward artifact can alter later execution decisions.

Threat narrative

Attacker objective: The attacker wants a cleanly approved skill environment to behave as an unsafe execution chain that can exfiltrate data, leak credentials, or bypass oversight.

1. Entry occurs when a skill package, cache, or metadata field is accepted as benign and loaded into the agent environment.
2. Escalation follows when the agent combines that approved skill with another skill or with persisted artifacts, creating behaviour the single-skill review never saw.
3. Impact appears when the composed workflow reaches an unsafe action, leaks tokens, or carries malicious influence into later sessions.

Breaches seen in the wild

• Sentry MCP Agentjacking 2026: Researchers showed a fake Sentry error, posted with a public DSN, could make AI coding agents run attacker code with developers' credentials.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Skill approval is the wrong trust boundary: The research shows that a skill can pass vetting and still become unsafe once the agent composes it with other skills, metadata, or persisted artifacts. That means the security question is not whether a single skill is clean, but whether the runtime graph can produce harmful behaviour from clean inputs. Practitioner conclusion: govern the composition path, not only the package.

Metadata is part of the control plane: Skill selection is influenced by what a skill says about itself, so metadata can steer routing before execution ever begins. That makes descriptive fields a security control surface, not just documentation. Practitioner conclusion: review skill metadata with the same suspicion normally reserved for executable content.

Persistent artifacts create cross-session identity debt: Cached files, configs, and generated outputs can outlive the session that created them and shape the next one. That breaks the assumption that each run starts from a neutral state, because prior outputs can function like a hidden privilege channel for later skills. Practitioner conclusion: treat artifact provenance as a first-class governance requirement.

Isolation checks do not solve composition risk: A skill scanner can clear the parts and still miss the whole. The study’s graph-based findings show that unsafe behaviour emerges when skills interact, which is why single-package review is structurally incomplete for agentic systems. Practitioner conclusion: move from static approval lists to interaction-aware governance.

Runtime orchestration is the named concept to watch: The real security problem is the gap between what each skill can do alone and what the agent can make them do together. That runtime orchestration gap is where benign components turn into unsafe workflows. Practitioner conclusion: build controls around execution paths, not around isolated approvals.

What this signals

Skill composition now matters more than skill approval: Governance programmes that stop at a pre-install checklist will miss the real failure mode, which appears when an agent combines multiple approved skills into one workflow. The control point is shifting from admission to orchestration, so programme owners need to evaluate interactions as a normal part of change management.

Execution provenance is becoming a governance requirement: When later sessions can inherit influence from earlier ones, the programme needs traceability for artifacts, not just for code. That changes incident response, because the question is no longer only who installed the skill, but what state survived into the next run.

Runtime orchestration gap: This is the practical blind spot in agentic AI security. A skill may be harmless in isolation, yet the agent can still assemble an unsafe path from clean pieces, so teams should watch for security reviews that ignore how skills are routed, combined, and reused.

For practitioners

• Map skill-to-skill handoffs Inventory which approved skills can feed outputs into other skills, then classify those paths by the privilege or data they can influence. The composition risk is the chain, not the component.
• Inspect metadata and bundled artifacts Review frontmatter, descriptions, caches, and compiled artifacts as part of admission control. A safe-looking skill description does not prove the runtime payload is safe.
• Add cross-session provenance checks Require provenance for files, configs, and generated outputs that can survive into later sessions. If a later skill can consume it, the artifact needs ownership, lineage, and deletion rules.
• Block approval-bypass directives Search for instructions that loosen oversight, including language that tells the agent to proceed without approval or skip verification. Those directives are governance events, not just text patterns.
• Test composition, not just single skills Run evaluations against multi-skill scenarios where one skill’s output becomes another’s input. Single-skill success does not demonstrate safe system behaviour.

Key takeaways

• Agent skill governance fails when teams treat approval as a property of the package instead of the runtime graph.
• Adversa AI found 612 insecure compositions among 13,598 clean ClawHub skills, which shows that composition can turn vetted parts into unsafe behaviour.
• The control that matters most is interaction-aware review, including metadata, persisted artifacts, and cross-session provenance.

Related NHI Mgmt Group resources: Agent Skills Security Guide · AI Agent Security Platform RFP · Vertex AI Agent Engine security guide · Sentry MCP Agentjacking 2026

Key terms

• Agent Skill: A reusable package of task-specific knowledge and procedures that an autonomous agent can load when needed. In practice, it separates general awareness from operational detail, which makes enterprise context easier to govern than a single oversized prompt.
• Skill Composition: Skill composition is the way multiple agent skills, tools or modules are combined into one runtime workflow. Security review focuses on the combined effect, because each component may be safe alone but create new authority, data exposure or side effects when chained with others.
• Execution Provenance: Execution provenance is the record of where, when, and under what authority a process, agent, or workload ran. In identity security, it links an action to its originating identity, environment, inputs, and approvals, supporting auditability, containment, and trust decisions across cloud, applications, endpoints, and AI systems.
• Runtime Orchestration: Runtime orchestration is the process of deciding which agent runs next, what it should do, and when the workflow stops. In agentic systems, this can be handled by an LLM, but that makes the orchestration layer part of the security boundary and not just application logic.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM or AI governance programme, it is worth exploring.