Large Language Model (LLM) agents are increasingly extended through external skills, tools,
plugins, and reusable instruction modules. These skills allow agents to perform complex tasks
such as file processing, web search, code execution, data analysis, and workflow automation.
However, current security checks usually evaluate each skill in isolation. A skill may appear
benign when tested alone, but become harmful when combined with other skills in the same
agent workflow.

This project investigates skill-composition poisoning in LLM agents. The key idea is that an
attacker may design or select multiple individually benign skills whose interaction causes unsafe
behaviour only when they are used together. For example, one skill may summarize user data,
another may transform or store intermediate outputs, and a third may send a final result. None of
these skills is clearly malicious by itself, but their composed execution path may lead to privacy
leakage, unauthorized actions, policy bypass, or misleading agent behaviour.

This research will develop a framework for identifying such composition-level risks. Instead of
asking whether a single skill is malicious, the project asks whether a set of skills can jointly
create an unsafe execution path. The project will focus on controlled, sandboxed LLM-agent
environments and will study both attack discovery and defensive detection.