ZODA Research | CoSA: Addressing Hidden Skill Conflicts in AI Agent Ecosystems

Consider a workplace mishap. One colleague prepares an internal candidate assessment that includes base salary information and shares it in a project chat. A second colleague notices the messy formatting and converts it into a polished document. A third assumes the standardized document is ready for external use and forwards it to a recruitment agency.

Nobody intended to cause harm. Each person was performing a familiar role. Yet confidential information left the company.

A similar problem can arise in AI agent workflows. As agents gain access to hundreds or thousands of reusable Agent Skills and combine them to complete complex tasks, a neglected security risk emerges: skills that pass individual checks can still produce unauthorized actions when composed.

ZODA, together with researchers from the Institute of Software and the Institute of Computing Technology at the Chinese Academy of Sciences, the University of Chinese Academy of Sciences, the University of New South Wales, the University of Science and Technology Beijing, and Fangcun Leap, recently released a study of this phenomenon.

The research formalizes Conflict of Skills (CoS) and introduces both the Conflict of Skills Attack (CoSA) framework and CoSA-Guard, a runtime defense implemented at the agent harness layer.

Across five LLMs and three open-source agent harnesses, adding skills equivalent to no more than 5% of each original skill pool increased the overall policy-violation rate from 35.02% to 58.45%.

1. How Can Individually Screened Skills Produce Policy Violations Together?

Existing agent security defenses commonly treat an individual skill package as the unit of inspection. They scan for malicious calls, prompt injection in SKILL.md files, and hidden data-exfiltration scripts. A package that passes these checks can then be admitted to the skill pool.

But static inspection cannot establish everything that will happen at runtime.

Consider the CI/CD example introduced in the paper. Three skills have each passed the specified package-level static security checks:

Skill A: Check build and deployment status.
Skill B: Collect materials for reproducing a failure.
Skill C: Run the validation steps configured in the pipeline. During troubleshooting, Skill A retrieves build and deployment information. Skill B prepares the context and materials needed to reproduce the failure. Skill C then uses the submitted code package to launch the reproduction process.

The sequence is functionally coherent, but it misses a crucial check: was execution of that code explicitly authorized? Having the materials needed to reproduce a failure does not establish permission to run them.

The agent continues along the workflow without rechecking authorization at the handoff, ultimately executing code without approval.

Each skill performs its declared local function: reading status, preparing materials, or running validation. The failure occurs when the output changes roles. Materials prepared for review become inputs to execution, while the restrictions attached to their original purpose are lost.

The agent establishes that one skill’s output fits the next skill’s input, but fails to establish whether the downstream use is permitted.

Figure 1. Combining individually screened skills leads to unauthorized code execution.

The paper defines this phenomenon as Conflict of Skills (CoS): an artifact or assessment signal produced by an upstream skill is reused downstream without preserving the restrictions or authorization required for its new use, causing the workflow to violate policy.

To examine whether these failures depend on composition, the researchers selected publicly available skills from ClawHub that passed static screening. They constructed 60 controlled requests and compared selected multi-skill compositions with matched controls exposing only one constituent skill.

Figure 2. Task-completion and policy-violation rates for single-skill controls and selected multi-skill compositions.

Both conditions achieved the same task-completion rate: 91.67%. However, the policy-violation rate increased from 8.33% in the single-skill controls to 68.33% in the multi-skill condition.

This exposes a gap between functional success and security compliance. An agent can complete the requested work while crossing a policy boundary during a handoff.

2. Why Do Existing Defenses Miss These Risks?

Could scanning the entire skill pool—or monitoring how often newly added skills are retrieved—identify the problem in advance?

The paper examines both approaches.

Static scanning does not capture the additional risk arising from cross-skill composition.

The researchers used the Cisco AI Defense Skill Scanner to inspect the original and augmented skill pools across four domains. High- and critical-severity alert counts remained unchanged after augmentation, while the overall runtime policy-violation rate increased from 35.02% to 58.45%.

Under the evaluated conditions, the scanner did not reflect the additional risk introduced by skill composition.

Added-skill retrieval rates are insufficient to predict increases in violations.

The study also examined the relationship between retrieval of added skills and the increase in policy violations. The association was weak.

Retrieving a new skill therefore does not adequately explain the additional risk. Analysis must also follow how its artifacts and assessments influence subsequent actions.

Both findings point to the same issue. Enterprise task policies govern information flow, approval status, and the objects on which actions may be performed. A general-purpose skill package describes a local capability. Determining whether its use is permitted requires the task policy and the full cross-skill execution trace.

Runtime verification must therefore consider the execution chain visible to the agent harness, rather than relying solely on static scanning or retrieval statistics.

3. Four Recurring Ways Skill Handoffs Fail

To analyze these failures, the researchers classify skill operations into six roles.

Figure 3. Six operation roles used to analyze skill interactions.

The roles distinguish information acquisition and processing from operations with consequential effects:

Information acquisition and processing: READ retrieves information from the environment; TRANSFORM converts formats, filters content, or derives artifacts; ASSESS produces scores, readiness judgments, or other decision signals.
Consequential operations: EXTERNALIZE discloses information to another recipient or system; MUTATE changes persistent resources or business state; EXECUTE runs code, scripts, or commands. The recurring problem is that information, artifacts, or assessments from upstream skills are reused for consequential operations without re-establishing the relevant restrictions and authorization.

The study identifies four mechanisms.

Security-context attenuation: sensitivity restrictions are lost during processing.

An upstream skill reads logs, configurations, or internal records and produces a summary. Restricted salary information, credentials, or secrets may remain in the content, while the restrictions governing their use are no longer preserved. A downstream skill then treats the summary as ordinary material and sends it externally.

Semantic interface bridging: an intermediate skill makes restricted data usable by a downstream operation.

Internal records may initially be incompatible with an external submission interface. An intermediate skill converts them into the required structured format. The downstream operation accepts the format without checking whether the content may be disclosed. The recruiting handoff example follows this pattern.

Semantic authority promotion: advice is treated as approval.

An upstream skill produces an assessment such as “low risk” or “recommend merging.” Although intended as advice, the signal is reused downstream as authorization to modify state or publish a change.

Target/action binding drift: a conclusion about one object is applied to another.

A downstream skill reuses a conclusion without preserving its original target or scope. Local-only materials may be sent to an external workspace, or a check performed in a test environment may be used to authorize a production change.

These mechanisms inform CoSA. The attacker controls only the added skills and their composition. Existing skills, the model, trusted instructions, planner, tools, and runtime permissions remain unchanged.

Using public business information and the functions, interfaces, and usage conditions declared by existing skills, CoSA identifies handoffs where restrictions may be lost. It then constructs additions that pass the specified package-level checks. The objective is to make an agent handling a legitimate request follow a functionally plausible workflow into an action beyond the task’s authorization.

CoSA constructs additions in two ways:

Capability supplementation: Supply a missing operation that allows a workflow to continue.
Relationship reshaping: Change how artifacts are organized, assessments are propagated, or actions are bound to targets, creating new handoff paths. Candidates are checked for domain relevance, interface compatibility, and static security requirements, then selected within a fixed budget. In the experiments, additions were capped at 5% of each domain’s original skill pool. Agents selected skills and planned their execution order autonomously.

Figure 4. CoSA construction, evaluation, and runtime defense.

4. CoSA-Bench: Small Additions, Substantial Increases in Violations

How readily do these failures occur when agents autonomously choose among available skills?

To investigate, the team constructed CoSA-Bench, containing 288 realistic business tasks across four domains: recruiting, finance, IT, and business.

The benchmark covers three risk categories:

Data leakage (DL)
Unauthorized state modification (UA)
Unsafe execution (UE) The original domain pools contain real ClawHub skills that passed static screening. CoSA then generated and screened additions based on existing capabilities and handoff relationships, ultimately adding two or three skills per domain.

The evaluation paired five LLMs—Qwen3.6, MiniMax-M3, DeepSeek-V4, GPT-5.6, and GLM-5.1—with three open-source agent harnesses: OpenClaw, OpenHands, and OpenCode.

This produced 4,320 matched pairs of runs, comparing original and augmented skill pools.

Figure 5. Changes in policy-violation rates across three agent harnesses.

Two findings stand out.

Small, individually screened additions increased violations across all model–harness combinations.

Policy-violation rates increased in all 15 model–harness combinations. Among the 4,320 matched pairs, 1,162 changed from compliant under the original pool to violating after augmentation.

Trace analysis found cross-skill dependency evidence involving an added skill in all 1,162 newly violating runs.

The effect depends on how additions connect to existing workflows, rather than pool expansion alone.

In the OpenClaw ablation, adding the same number of randomly selected, same-domain skills that passed screening reduced the violation rate from 31.94% to 26.39%.

By contrast, the full CoSA construction and selection process increased it to 54.24%.

These results support examining the content and handoff relationships of added skills, rather than treating a larger skill pool as the explanation for increased risk.

5. CoSA-Guard: Checking Critical Handoffs at Runtime

If restrictions and authorization can be lost during skill handoffs, package-level inspection needs to be complemented by runtime verification.

The researchers therefore designed CoSA-Guard, a lightweight defense at the agent harness layer. Implemented as a pre-action hook, it checks security conditions before information disclosure, persistent state changes, or code execution. It requires no changes to existing skills or tool permissions.

Before a consequential action proceeds, CoSA-Guard considers the execution trace so far, cross-skill dependency evidence, trusted authorization records, and task policies visible at runtime.

It performs two checks:

Information-flow check: Trace the information’s provenance, sensitivity, permitted use, and release scope. Determine whether it may still be sent to the proposed recipient or used for the proposed operation after upstream transformations.
Authorization check: Verify that trusted approval explicitly covers the proposed action, object, target, and purpose. Recommendations such as “merge” or “hire” must not be mistaken for formal authorization. An action proceeds only when both checks pass. Otherwise, CoSA-Guard blocks it, requests confirmation, or reports an error.

Deterministic rules handle explicit conditions, while a judge model assists with ambiguous natural-language evidence.

The researchers evaluated CoSA-Guard on the OpenClaw recruiting tasks, the domain with the highest violation rate in that harness.

Policy violations fell substantially.

The overall violation rate decreased from 65.28% to 6.67%, a reduction of 58.61 percentage points.

Of the 139 defended runs that produced a risky action, 115 ended in a valid block, yielding 82.73% risk coverage.

Figure 6. Policy-violation rates with and without CoSA-Guard.

Policy-compliant task completion changed only modestly.

Across matched benign controls for the five models, Policy-Compliant Task Completion (PCTC) decreased from 66.67% to 65.00%, a difference of 1.67 percentage points. The overall false-block rate was 3.33%.

Figure 7. Policy-violation and policy-compliant task-completion rates with and without CoSA-Guard.

6. Rethinking Skill Security for the Agent Era

Just as apps packaged services and capabilities for the mobile internet, skills are becoming reusable units of domain expertise, business workflows, and value delivery in agent ecosystems.

Third-party developers and enterprise users are increasingly packaging capabilities in this form. Securing their interactions is therefore essential.

As AI moves into real-world applications, security is one of several foundational challenges. Progress from Physical AI to world models depends on high-quality data, rigorous benchmarks, and advances in algorithms.