What is the best way to detect malicious agent skill composition?

How to detect malicious agent skill composition

The best detection method is to model agent skills as a runtime capability graph, not as isolated files or prompts. That lets you see which skills, tools, permissions and data paths become reachable together when the agent runs, which is where malicious composition usually hides. The practical question is whether a supposedly harmless skill creates a path to broader privilege, sensitive data or persistent state.

For that reason, detection should focus on composition behaviour, not just static content. A skill can look benign on its own but become dangerous when chained with another skill, inherited permissions or a shared context store. The graph view exposes those joins, so you can spot privilege chaining, transitive access and state reuse before they are exercised in production.

For skill-layer security, the most useful baseline is OWASP Agentic Skills Top 10 (AST10), which frames malicious skill chains, inherited permissions and credential exposure as first-class risks. If your environment uses published or shared skills, pair that with NHIMG’s Agent Skills Security Guide so you can review the skill metadata, allowed tools and script surface together rather than treating the skill as a single trusted unit.

What to look for in a malicious skill chain

A malicious composition is usually revealed by an unexpected path from trigger to action. The path may cross a benign-looking skill, then a tool call, then a permission boundary, and finally a sensitive operation that the original skill should never have been able to influence. Hidden transitive access is especially important when one skill inherits capabilities from another or reuses a context that was created for a different task.

Another common signal is inconsistent reachability. If a skill can only work when a second skill is already loaded, or if it relies on data or tokens that were not explicitly granted for that step, the composition is doing more than the declared skill contract suggests. That is where malicious placement, deceptive tool descriptors and poisoned skill metadata tend to matter.

For a broader agentic threat model, OWASP Agentic AI Top 10 is useful because it treats identity and privilege abuse, tool misuse and supply-chain exposure as distinct failure classes. NHIMG’s OWASP Agentic Top 10 ASI04 Guide adds the specific operational habit that matters here: vet, pin and sandbox the skills and services that can be reached through the chain.

Which controls improve detection quality

Static review alone is not enough, because the same skill set can be safe in one context and dangerous in another. The control objective is to compare declared intent with actual runtime reachability. That means instrumenting the agent so you can observe the full directed path, including tool invocation order, permission expansion, inherited context and any cross-skill data transfer that was not obvious in the original design.

Detection improves when you also baseline what good composition looks like for each agent role. Once you know the normal graph, deviations become easier to flag, including a new edge to a sensitive tool, an unplanned permission hop or a data path that should not exist for that task. That is much more reliable than looking for suspicious text inside a skill definition, because malicious composition often depends on how safe pieces are combined.

For the runtime and governance side, Top 10 Agent Identity Controls helps with inventory, short-lived access and delegation boundaries, which are exactly the signals that make dangerous composition visible. If you also need a broader operating model for logging, attribution and incident response, AI Agent Observability, Audit and Incident Response Guide gives the supporting telemetry and escalation logic for when a composition starts acting outside its intended path.

Practitioner Guidance

What to prioritise: Build detection around reachable capability graphs, not around skill names or manifests. The first useful question is whether a composed path can reach a privileged action, not whether each individual skill looks safe in isolation.

What to verify: Confirm that every edge in the runtime graph is intentional, attributable and bounded by the agent’s declared task. If a skill can inherit a tool, permission or stateful context that the review never approved, treat that as a detection gap even if no abuse has been observed yet.

Decision rule: If a composition creates new reachability to sensitive data, external actions or elevated permissions, escalate it as a control failure and inspect the entire path before you rely on any single skill verdict. The dangerous part is usually the interaction, not the component.

Practitioner takeaway: The safest detection posture is to prove what an agent can actually do end to end, because malicious composition is almost always a path problem disguised as a skill problem.

Related resources from NHI Mgmt Group

• Detect
• What is the difference between human identity governance and AI agent governance?
• When does AI agent access create more risk than it reduces?
• What is the difference between governing human access and governing AI agent access?