CoSA shows a handful of locally admitted skills can raise agent policy violations from 35% to 58%

A skill can be clean in isolation and still hand another skill the wrong knife. CoSA is built to measure that gap.

Zheng and colleagues posted arXiv:2610.35082 on Conflict of Skills: policy violations that appear only when individually admitted skills exchange artifacts or decisions. The claim under test is the one operators reach for after scanning a marketplace: that package-level checks are enough.

Locally clean skills get treated as a safe pool

The claim under test says that if each Agent Skill passes package-level static security checks, the composed skill pool is safe enough to run when agents select skills autonomously. In that framing, scanners that inspect instructions, scripts, manifests, and bundled resources for hidden attack logic are treated as sufficient admission control. Cross-skill reuse of artifacts and assessments is assumed to inherit the restrictions of the original purpose.

Marketplace language and internal skill catalogues often collapse "every package passed the scanner" into "the workflow is authorised." CoSA separates those sentences.

CoSA-Bench pairs original and augmented pools on fixed tasks

The claim is pressure-tested in "CoSA: The Conflict of Skills Attack in Real-World LLM Agent Ecosystems" (arXiv:2610.35082), with project page at sigmir-org.github.io/CoSA. The authors formalise Conflict of Skills, identify four recurring mechanisms from controlled executions of public skills, and introduce CoSA: budgeted additions that pass individual checks while supplying missing business operations or reshaping artifact exchange, decision reuse, and target/action bindings. Existing skills and runtime permissions stay unchanged.

CoSA-Bench builds 288 tasks across recruiting, finance, IT, and business from real-world skills and controlled services, covering data leakage, unauthorised state modification, and unsafe execution. Paired runs compare original and augmented pools under autonomous skill selection. Evaluation spans five LLMs and three agent harnesses.

Violations jump 23 points; a pre-action guard collapses OpenClaw recruiting risk

With augmentation capped at 5% of each original skill pool, CoSA raises the pooled policy-violation rate from 35.02% to 58.45%, an increase of 23.43 percentage points; across the evaluated models and harnesses, with increases across all four domains and three risk categories. Trace analysis links compliant-to-violating transitions to cross-skill dependencies involving the additions. The increase is only weakly associated with added-skill retrieval and occurs without changes in the evaluated scanner's severe-alert counts.

On OpenClaw recruiting tasks across five models, a lightweight harness-level guard that checks information flow and authorisation before consequential actions reduces violations from 65.28% to 6.67%, while policy-compliant task completion on matched benign controls moves from 66.67% to 65.00%.

Package checks would need to see downstream reuse

For local admission alone to underwrite pool safety, package scanners would need to foresee how artifacts and assessments will be reused by other skills under autonomous selection, or the runtime would need to carry purpose restrictions with every artifact. CoSA's threat model denies the attacker the need to modify existing skills or expand runtime permissions; the additions are domain-relevant and individually benign by the same Π checks the defender already trusts.

That would also require task success metrics to surface composition failures. The OpenClaw numbers show violation rate and benign completion can move in opposite directions from a guard that inspects flow and authorisation at action time; evidence that scanner-clean pools still need a runtime gate.

Local admission overstates pool safety on this composition suite

Overstated. Local package admission is real and necessary; it is insufficient evidence that an autonomously composed pool will stay inside policy. On this suite, a 5% budget of locally admissible additions lifts violations from about 35% to about 58%, and scanner severe-alert counts do not track the jump. The OpenClaw guard result supports a different operational sentence: check information flow and authorisation before consequential actions.

too_early would apply to any claim that the published guard generalises unchanged to every harness outside OpenClaw recruiting. unsupported would apply to a claim that skills which pass Π cannot cause CoS; the paired evidence contradicts that.

Say local admission, then measure composition under a flow guard

Language we will use instead: Agent Skills that pass package-level checks can still raise policy-violation rates when a few locally admissible skills are added to the pool; on CoSA-Bench that lift was 35.02% to 58.45% at a 5% addition budget across five models and three harnesses. Prefer runtime information-flow and authorisation checks before consequential actions; on OpenClaw recruiting, one such guard cut violations from 65.28% to 6.67% with little change in benign completion.

Do not say the skill marketplace is safe because every package scanned clean. Do not say CoSA proves every production skill pool will jump twenty-three points; cite the bench, budget, and harness set.