> Helps identify when individually benign skills compose into dangerous capability
> combinations — the attack surface that per-skill auditing cannot see.
A skill that reads files is benign. A skill that sends HTTP requests is benign.
An agent that has both can exfiltrate files — and no individual skill audit will
flag it, because neither skill is doing anything wrong on its own.
This is the capability composition problem. Agent security tooling inherited from
software security tends to analyze skills in isolation: does this skill request
excessive permissions? does this skill contain malicious code? These are the right
questions for individual skills. They are the wrong questions for understanding
what an agent can do.
What an agent can do is the product of its capability set, not the sum of
individual skill assessments. An agent with twelve benign skills may have
emergent capabilities that no skill declared and no auditor reviewed. A poisoned
skill dropped into that composition inherits everything the agent can already
reach — and the blast radius is determined by the composition, not the skill.
The attack surface that matters is not what any individual skill can do. It is
what the agent's combined capability set enables.
This analyzer examines capability composition risk across five dimensions:
risk when combined? read-files + send-HTTP, execute-code + network-access,
read-environment + write-logs are canonical examples. The analyzer checks for
known dangerous compositions and flags novel combinations that share structural
properties with them
have that no individual skill declared? A skill that can read arbitrary paths
and a skill that resolves environment variables together create an effective
"read secrets" capability that neither declared
what capabilities does it immediately inherit? The inherited capability set
determines the potential blast radius of any single skill compromise
exceed its declared permissions? Gaps indicate either undeclared scope or
capability composition the publisher did not model
Rapidly changing compositions create new dangerous combinations faster than
audits can track them
Input: Provide one of:
Output: A composition risk report containing:
Input: Analyze capability composition for agent with skills:
file-reader, http-requester, env-resolver, log-writer, code-executor
🔗 CAPABILITY COMPOSITION ANALYSIS
Agent skill set: 5 skills
Declared permissions: file-read (scoped), network-outbound (scoped)
Audit timestamp: 2025-05-01T09:00:00Z
Dangerous pair inventory:
file-reader + http-requester: ⚠️ HIGH
Effective capability: file exfiltration
Neither skill declares exfiltration intent
Path: read arbitrary file → send as HTTP body/parameter
env-resolver + http-requester: ⚠️ HIGH
Effective capability: credential exfiltration
Environment variables commonly contain API keys, tokens
Path: resolve $API_KEY, $DB_PASSWORD → send outbound
code-executor + network-access: 🔴 CRITICAL
Effective capability: arbitrary remote code execution staging
Path: fetch payload → execute locally
log-writer + file-reader: ✅ LOW
No dangerous composition identified
Emergent capability surface (undeclared):
- Secret exfiltration (env + HTTP) — not declared in any skill
- Arbitrary file exfiltration (file + HTTP) — scope exceeds declared "scoped"
- RCE staging (executor + network) — not declared
Permission declaration gaps:
Declared: file-read (scoped to /app/data)
Effective: file-reader can access any path agent process can read
Gap: declared scope not enforced at composition level
Inheritance amplification:
If any skill slot is compromised, attacker inherits:
- File read (all accessible paths)
- Outbound HTTP (all accessible endpoints)
- Environment variable access
- Code execution
Combined: full agent compromise with exfiltration path
Composition risk level: CRITICAL
Five individually-audited skills compose into an effective
remote access and exfiltration toolkit. No individual audit
would flag this — it is only visible at the composition level.
Recommended actions:
1. Apply capability isolation: skills that read files should not
have access to network-capable skills' output channels
2. Scope network-outbound to specific allowlisted endpoints
3. Add composition policy: no agent should hold both arbitrary
file-read and arbitrary network-outbound simultaneously
4. Audit any agent inheriting this skill set for composition drift
compromised; capability-composition-analyzer determines what the compromised
skill immediately inherits
permissions; composition analyzer detects dangerous emergent capabilities
across multiple appropriately-scoped skills
risk may only activate the dangerous path after establishing context
manifests at runtime when capabilities are exercised together
Capability composition analysis requires accurate capability metadata for all
skills in the agent's composition. Skills that do not declare capabilities
accurately — or that acquire capabilities dynamically at runtime — will produce
incomplete composition maps. The dangerous pair inventory covers known
composition risks; novel compositions with no prior pattern may not be flagged.
Effective capability analysis is necessarily conservative: it identifies what
the composition could do, not what it will do. False positives are expected for
agents where dangerous capability pairs exist but are operationally isolated by
other means. Composition analysis is a complement to per-skill auditing, not a
replacement — individual skill integrity remains necessary even when composition
risk is low.
共 1 个版本