Skill Composition

How skill composition changes the security problem

Skill composition is not just a design choice, it changes the trust boundary. A workflow can inherit the permissions, inputs and side effects of every skill it chains together, so the security question shifts from “is each part safe?” to “what happens when they interact?”. That is where hidden privilege, unexpected data flow and unsafe chaining appear.

In practice, composition can turn a narrow, well-scoped action into a broader operation that can read, transform, send or trigger more than the designer intended. The combined workflow is the real security object, because the least safe step in the chain can dominate the overall risk posture.

Authority, data flow and side effects in chained skills

When skills are composed, authority often becomes cumulative. A skill that only formats text may be harmless alone, but if it receives sensitive context from another skill, its output may leak data, influence decisions or route information into an external system. This is why chained execution needs to be reviewed as one system rather than as isolated modules.

Data exposure is also easier to miss in composed workflows because intermediate outputs often look routine. A skill may pass tokens, identifiers, prompts or retrieved content to the next step without any single component appearing unsafe in isolation. The security impact comes from the handoff points, not just from the components themselves.

Composition can also create side effects that are hard to predict from the skill catalog alone. A sequence that appears to perform simple assistance may in fact call tools, change records, send messages or create tickets. Those side effects matter because they widen the set of actions that an attacker, a misconfiguration or a bad instruction can trigger.

Where skill composition breaks safety assumptions

Security review needs to account for assumption drift. Teams often assume that a curated skill is safe because it was approved once, but composition can change the meaning of that approval. A safe skill can become unsafe when it inherits broader context, more sensitive inputs or higher authority from the workflow around it.

Another failure mode is implicit permission inheritance. If one module has access to a resource and a second module can influence its input, the composed workflow may effectively grant the second module that access path. That is a common source of privilege inflation in multi-step agentic designs.

Composition also increases the chance of hidden dependency risk. If one skill depends on another skill’s output format, failure or manipulation in the earlier step can cascade into incorrect actions later in the chain. The result is often not a single broken module, but a brittle workflow whose security properties only hold when every step behaves exactly as expected.

How practitioners should evaluate composed workflows

Review the workflow as the unit of security analysis, not the individual skill catalog entry. The important questions are what each step can see, what it can change, what it can trigger and what authority it inherits from the surrounding chain. That is especially important when a composed workflow crosses system boundaries or mixes retrieval, action and decision steps.

Provenance and policy need to follow the composition, not just the component. If a new skill is added to a workflow, the effective data exposure, control surface and failure modes change even when the skill itself looks routine. A composition-safe design treats every added connection as a new trust decision.

For broader guidance on evaluating agent skill layers and chained authority, see the OWASP Agentic Skills Top 10 (AST10), which frames the security risks that emerge when skills are combined into runtime workflows.

Risk and Threat Considerations

Composed skills can create a larger attack surface than the sum of their parts. An attacker may not need to break a single skill if they can manipulate the order, inputs or trust relationships between skills, causing the workflow to disclose data, misuse authority or trigger unintended side effects.

Failure mechanism: Composition introduces chained trust, so a weak step, unsafe handoff or overbroad inherited permission can turn a benign module into an exploitation path. The risk is strongest when one skill can influence another skill’s inputs, outputs or tool use without a compensating policy check.

Impact: The resulting compromise can include data leakage, unauthorized actions, poisoned outputs, audit ambiguity and broader workflow abuse. In agentic systems, that can also create persistent misuse of tools or credentials across repeated runs.

Practitioner Guidance

Why practitioners should care: Skill composition is where design intent often diverges from runtime reality. Security owners should validate the combined workflow, not just approve individual skills, because the effective authority and exposure profile can change as soon as skills are chained.

Common misunderstanding: “Approved components make the composed workflow safe” is usually false. A composition can become insecure even when every component passed review, because the risk emerges from interaction, inheritance and sequencing.

Practitioner takeaway: Treat every composed workflow as a new security boundary, and re-review it whenever the chain, data inputs or delegated actions change.

Related resources from NHI Mgmt Group

• Should organisations prioritise tool scoping or skill governance first for AI agents?
• What should organisations do when an agent skill can silently replace another skill?
• Should organisations use security skill prompts instead of access controls for AI agents?
• What breaks when agent skill registries can deliver malicious installers?