Runaway Reaction: When Benign Skills Compose into Malicious Behavior

Agent skills package task-specific knowledge and procedures that can be composed to support complex agent tasks, while public marketplaces provide a growing pool of reusable skills. Existing security vetting, however, largely evaluates skills in isolation, leaving composition-induced risks underexplored. Such risks arise because composing benign skills expands the agent’s capability space, enabling behaviors unavailable to any skill alone. Interestingly, we find that directly composing benign skills can already induce malicious behaviors, even when every individual skill passes security vetting. We further find that some target malicious behaviors remain difficult to realize through direct composition, even when the selected skills collectively provide the required capabilities. To systematically evaluate this vulnerability, we present Compositional Risk Induction via Multi-skill Execution (CRIME), a framework consisting of three components. CRIME first uses the Malicious Plot Casting module to decompose a target malicious behavior into complementary requirements and identify suitable skill com positions. For initially ineffective compositions, the Runaway Reaction Steering module uses execution feedback to refine the selected skills toward the target while preserving their standalone benignity. The resulting composition is then passed to the Skill Reaction Chamber module, where the skill pair is executed in a sandbox to determine whether the target behavior has occurred, with unsuccessful cases returned for further refinement. Furthermore, we construct a benchmark of 4,000 public skills across eight cybersecurity behaviors for systematic evaluation of composition-induced vulnerabilities. Experiments across multiple LLMs reveal malicious behaviors in both direct and optimized compositions, showing that individual skill inspection is insufficient to capture multi-skill security risks.